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FOREWORD 


This report documents The Aerospace Corporation effort on 
Study 2.2, Payload Design Requirements Analysis* performed under 
NASA Contract No. NASW-2472 during Fiscal Year 1973. The Aerospace 
study was monitored by Dr. R. W. Johnson, NASA Headquarters; 

O. Dallancc, Marshall Space Flight Center; and R. A. Berglund, 

Johnson Space Center, and their efforts as a team in providing technical 
direction throughout the durrtion of the study are greatly appreciated. 

This volume is one of three volumes representing the fina? report 
of Study 2.2. The :hree volumes are: 

Volume I Executive Summary 

Volume II Payload Design Guidelines 

Volume III Giridcl.-\e Analyses 

Volume I summarizes the overall report iu brief form and 
includes the relationship of this study to other NASA efforts* significant 
results, study limitations* suggested research, and recommended additional 
effort. 

Volume II ^:>i’ovides the design guidelines in concise format with 
sufficient information to permit tradeoff results. It also includes th^ 
application of the guidelines to an example satellite as a demonstration 
of their usefulness. 

In Volume III, all of the analyses that were performed are 
documented to provide traceability. These analyses include analytical 
technique, design analyses of the Large Space Telescope and the Shuttle- 
Launched Defense Support Prograrr (SLDSP) payloads, common hardware, 
and Sortie payload operations. (Figures showing conceptual design of the 
SLDSP were intentionally left out of Volume III for security reasons, but 
they are available from the Study Director upon establishment of need to 
know.) The subsystem analyses are presented in the appendixes of 
Volume III. 
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1. INTRODUCTION 


A. GENERAL 

Prior studies have indicated that the Space Transportation System 
(Shuttle plus Tug) should produce a large reduction in overall payload costs 
as a result of improved payload design and operational techniques. This 
study was conducted to provide data and insight into the methods of achieving 
these economic gains. 

The study treats only payloads that will be launched on the Shuttle/ 
Tug/Sortie Lab combinations. These payloads are of four types: 

Expendable 
Ground Refurbishable 
On-Orbit Maintainable 
Sortie 

The expendable payloads addressed in this study are designed specifically 
for the Shuttle/ Tug and not for expendable launch vehicles. Econonnic com- 
parisons are made only between these four types of Shuttle payloads, and 
not between these payloads and current expendable launch vehicle payloads. 

The FY 1972 study that preceded this study identified a series of 
design guidelines that were dociunented in a Reusable Payload Specification 
report (Ref. 1). The FY 1973 study attempted to quantify several of these 
guidelines that were identified to be cost effective. Additional system guide- 
lines were also developed in this study by analyzing two payloads parametrically 
and demonstrating the results on an example satellite. In addition to analyz- 
ing the selected guidelines, emphasis was placed on providing economic 
tradeoff data and identifying payload parameters influencing the low cost 
approaches. Thus, in no way should this study be considered to represent 
a point design effort. The economic analyses reported in these voltunes 
should be viewed as providing trend data rather than absolute cost data. 
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This volume documents the analyses that were performed in 
developing the design guidelines prsented in Volume 11, Payload Design 
Guidelines . The analytical techniques and design analyses that are pre- 
sented in this volume provide traceability in the approach, data generation, 
and data flow for the design guidelines on low -cost- type payloads. The 
analyses on the other guidelines such as reliability, modularity, ground 
operations, and subsystems are presented in the appendixes since they were 
performed independently. 

The common hardware and Sortie payload operations tasks were 
special emphasis tasks in this study. The common hardware concept has 
a potential for large cost reductions and was therefore examined in detail 
to determine its technical feasibility. This analysis was favorable for 
Shuttle payloads and resulted in a design guideline. The Sortie payload 
operations task was conducted to investigate the integration of two scientific 
disciplines into a multi experiment Sortie payload. When the two disciplines 
selected for integration were found to be incompatible, the mission capa- 
bility was expanded in one of the disciplines to update the Sortie mission 
by incorporating additional experiments. 

B. BACKGROUND 

During Fiscal Year 1972, a payload analysis for Space Shuttle appli- 
cations was conducted by The Aerospace Corporation to identify design guide- 
lines for reusable payloads (Ref. 1). The FY 1972 payload design guidelines 
resulted principally from an overall review by specialists experienced in the 
design of satellites of Shuttle payload studies performed to that time. 

In continuing this work during FY 1973, The Aerospace Corporation 
was able to use more definitive data on the Shuttle, Tug, Sortie Lab, and 
payloads from NASA and DOD studies to develop additional guidelines and 
to quantify the FY 1972 guidelines. Since only a portion of the FY 1972 
guidelines could be examined in depth within the scope of the FY 1973 effort, 
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it was decided to analyze only one guideline pertaining to each subsystem 
along with a number of system guidelines. Each subsystem specialist 
analyzed his guideline from the viewpoint of technical feasibility or cost. 

The system guideline analysis on low-cost-type payloads was performed in 
terms of cost. Other guidelines were primarily analyzed for technical 
feasibility with some supporting qualitative cost information. 

It was the intent to analyze as many of the guidelines as possible 
to see how they would apply to a Shuttle payload, what tradeoffs would arise, 
and what guidelines would prove practical for a serviceable payload. 
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2. ANALYTICAL TECHNIQUE 


A. GENERAL 

This effort was performed to develop analysis techniques for deter- 
mining total payload program cost as a function of payload paraimeters. 

These cost relationships were found by developing a mathematical model to 
perform the parametric tradeoffs on the computer. This task was also used 
to identify specific tradeoffs that should be carried out because of their sensi- 
tivity to program costs. To relate the parametric analysis to actual cases, 
two satellites were selected to represent a low altitude mission and a high 
altitude mission. This section describes the mathematical model, computa- 
tional flow, and parameters involved in the trade studies. The cost trend data 
and the sensitivity of the parameters are presented in Section 3. 

The computational flow of the mathematical model is shown in 
Figure 2-1. The reliability model and module simulation program are 
described in the SAMS Systems Optimization Program later in this section 
as are the Spacecraft Synthesis Program and the Payload Cost Program. 
Because of the large quantity of data that is produced, a data analysis and 
sum? lurization program was developed to search the stored cost data in the 
Payload Cost Program to identify the lowest cost concepts for a given set 
of conditions. 

Also shown in the computational flow diagrams are the parameters 
that were varied in each of the computer programs. These parameters were 
systematically varied to determine their cost sensitivities for a given mission 
description. The remote terminal computer facility was used to provide com- 
nnt vtional flexibility during the development of SAMS. The payload cost 
program was converted from CDC/FORTRAN to the remote terminal/advanced 
programming language (APL) to also provide development flexibility. Output 
of each program was printed, and the input into the next computer program 


J>RECEDING PAGE BLANK NOT FEMS> 


5 



VARIABLES: VARIABLES 


c 

o 


m 

m >4 


bO M O 
>4 0 ^ 



§ 


Q. 

JT a o 
»««)»« 
H05CU 




I 

(M 

0) 

u 

:3 

00 

•1^ 

U4 


6 


Computational Flow Diagram 




was automatic except for those programs where there was not sxifficient 
workspace in the remote terminal to store the data. In those cases where 
the data exceeded the workspace, the inputting was performed manually. 

Within each program in the mathematical model, analysis was 
required to develop appropriate factors or coefficients for the computation 
to process the data. In the case of the reliability model, data on the relia- 
bility diagrams, failure rates, type of redundancy, and parts weights were 
required to develop the payload subsystem redundancy and reliabilities. 

The Spacecraft Synthesis Program required design factors to convert from 
expendable to g round -refurbishable and on-orbit maintainable payloads. 

The Payload Cost Program required redundancy cost factors to account for 
changes in mean mission duration (MMD) from the baseline payload. The 
development of these factors and equations are described in this section. 

B. SPACECRAFT SYNTHESIS PROGRAM 

1 . INTRODUCTION 

This computer program was developed to provide the necessary 
payload data to calculate payload costs which can be related to certain 
parameters of Shuttle payloads. The parameters of interest to the study 
include the effect of ground refurbishability, variation of MMD, and the 
ntunber of modules in spacecraft designed for on-orbit maintenance. Some 
preliminary analyses were also conducted to determine factors for Sortie 
missions. The Spacecraft Synthesis Program also had the capability to vary 
basic parameters such as electrical power, pointing accuracy, propellant 
type, velocity increment, etc. Where necessary, the spacecraft shape could 
be modified to be compatible with the Orbiter cargo bay. The spacecraft 
data resulting from the variation of these parameters would be used as pri- 
mary inputs to cost analysis routines. 

The Spacecraft Synthesis Program was developed jointly with sup- 
port from Study 2.4 and is thus more extensive than if it had been developed 
for either study alone. 
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The Spacecraft Synthesis Program can be used to develop subsystem 
data for most satellites. In this study, these satellites include the Shuttle* 
Launched Defense Support Program (SLDSP) and the NASA Large Space 
Telescope (LST) and Earth Observatory Satellite (EOS) program. This 
section of the report describes the development and operation of the Space- 
craft Synthesis Program and the equations. 

2. SYNTHESIS PROGRAM DESCRIPTION 

The Spacecraft Synthesis Program has been prepared in both 
Fortran IV and APL format and can be used on both the CDC 7600 and the 
IBM 370 at The Aerospace Corporation. English rather than metric units 
are used to facilitate interface with other computer routines. Where con- 
venient, actual values for parameters of lesser influence have been incorpo* 
rated as fixed values. Where the influence of the variable is a complex 
function, the equation for the influence is included in the program and is 
automatically treated. For example, the modularity variable is defined by 
an exponential equation. In using the program, the operator need only input 
the number of modules to be studied. These automatic features reduce 
errors in the program operation and expedite the computations. 

The computer develops subsystem weight and other payload data 
as functions of the input parameter values. Equipment subsystems are 
computed first. The structure and thermal protection subsystems, which 
are partially dependent on the equipment subsystem data, are produced next 
by iteration subroutines. The final step is the development of the payload 
adapter weight and length. 

A simplified flow diagram for the Synthesis Computer Program 
is depicted in Figure 2-2. The equations developed for the program are 
delineated and described in the ensuing paragraphs. The completed pro- 
gram is, of course, tested against existing satellites periodically. 

Two types of subsystem weight estimating equations were developed 
for use in the synthesis program. The first type includes basic equations 
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Figure 2-2. Spacecraft Synthesis Computer Program FUnv Diagram 










for estimating the weights of subsystems of current expendable satellites. 
Actual satellite data were collected from NASA and DOD programs to per- 
mit generation of these basic equations. The second type of equations offers, 
in essence, factors for modifying the subsystem weights for Shuttle 
payloads. 

The basic subsystem weight estimating equations were developed 
by establishing an analytical model and correlating data from existing satel- 
lites with the model to produce the equations. The data were correlated 
using a regression analysis computer routine. Parameters having a low, 
or constant, influence were incorporated as fixed values for simplication. 

The basic weight equations for the subsystems are delineated in Table 2-1. 
The symbols are described as they first appear. The correlation of actual 
satellite data with the developed equation is shown in Figure 2-3 for the 
structure subsystem. These equations are continually being refined and 
expanded as data become available. For this study, the equations that were 
available on 28 February 1973 were used and were not updated. 

The use of the basic equations will permit computation of data for 
satellites of the expendable type that are now being fabricated for launch 
on expendable vehicles. To modify these designs for Shuttle applications. 
Shuttle application factors, in equation or coefficient form, were developed 
for the subsystem equations within the program. 

Ground-refurbishable payloads are designed to permit on-orbit 
retrieval and repair or updating on the ground. The synthesis program 
provides for these features by adding a docking structure to the expendable 
satellite 45.4 kg (100 lb), adding a targeting component 4.5 kg (10 lb), and 
increasing the structure by a factor of 1.10 to provide increased access to 
interior components. 

Mean Mission Duration (MMO) and design life of payloads were 
varied for Shuttle applications. To incorporate this feature, studies were 
conducted which determined the increase in the number of components 
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Table 2-1. Basic Weight Equations 


1 . 


2 . 


3. 


Structure 


W = K 
s 




096 


where: 


K. 


= Density Coefficient 

= 0.219 for satellites with body-mounted solar cells 
(ENDO) 

= 0. 128 for satellites with extendable solar panels 
(EXO) 

= Weight of Satellite contents, pounds 
L/jj = Satellite length -to -diameter ratio 

Thermal Control (Passive) 

W^ = 0.025 W 
tc sc 


W 


where: 

W^^ = Satellite weight, pounds 

Electrical - Batteries 

= 0.167 (T,) (1 7 R) (0. 

where: 

Pj^at “ Battery power required during eclipse, watts 

T^ = Time in eclipse, hours per orbit 

R = Redundancy factor (e. g. R = 0. 5 = 50%) 

IOC = Year of initial operational capability 
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Table 2-1. Basic Weight Equations (Cont'd) 


4. Solar Arrays (Synchronous Orbits Only) 

Body mounted: 

Q ggdOC- 1960) 


0.264 P 


W 


s/a 


s/a 


(T.Sb - 0.03l4 Life 


0.38 


+ 0.35 


Oriented Paddles - Rigid Substrate: 


0.120 P 


W 


s/< 


s/a 


0.86 - 0.0314 Life 


PF 


+ 0.35 


0.99 


(IOC- 1960) 


Oriented Panels - Flexible Substrali’: 
0.109 P 


W 


s/a 

s/a ■ I 0.86 - 0. 3l4 Life 


0.4 


+ 0.35 


0.99 


(IOC- 1970) 


where: 


Life 

PF 


Total solar array power requirement, watts 

Design life of spacecraft, years 
Rat io of solar cell- to- substrate areas 


5, Electrical Harness 

W, 


0.0149 (W )‘ 

eq sc' 


where: 


W 


eq 


V 

sc 


We’glit of power consi iiing equipment, pounds 
Volumt* of spaci^craft, cubic feet 


12 





Table 2-1. Basic Weight Equations (Cont'd) 


6. Electrical - Power Conditioning 


W - 0 i86 (P , ) 

po s/a 


0 73 


Guideuice. Navigation and Stabilization 
Three axiB control: 

W = 0.648 (W (PA)'*^' 

gas sc 

Spin stabilization: 


W = 0 558 (W f (PA)'”-^® 
gus sc 


where 


\V - Wright of sp;»s'(crafl on orbit, pounds 

Si ^ 

PA - P inline accurjcy, drgrres 


Se Reaction Control Propellaints - 


W ^ 0.0273 w (Life)”'®'"* 

p sc 


9. Reaction Control Subsystem Hardware - N_H 


0 . H44 


W 0.619 (W ) 

rc . p 





10. 


11 . 


Table 2-L Basic Weight Equations (Cont'd) 


Communication, Data Processing, Instrumentation 


\r 


cdpi 


50 + 5(H) 


0 . 1 


(N,,-l) + 15 N, t D + ENC 
ai tr p 


where: 

H 

N 


dl 


= Orbit altitude, nautical miles 
= Number of down links 


= Number of tape recorders 
= Data processing equipment weight, pounds 
= Encryption equipment weight, pounds 
Adapter Weight 


“tr 

ENC 


t* = 


4i 


0. 5 


27TE + 9 (^) 


0.6 


D ^ ^ 2t ^ 
+ u. 16 (^) (^) 


W J = K ,7TD£ to 
adapt ad a P 


W 

f 

D 


t 

E 

P 

K 


ad 


= Load on adapter, pounds 

= Adapter diameter (average), feet 
= Adapter length, feet 

= Centroid of adapter load to centroid oi dapter, feet 

= Adapter shell thickness, feet 
= Modulus of elasticity 

= Material density, pounds per cubic foot 
= Ratio of realistic-to- theoretical weight; 1.5 

= Automatically iterated within program 
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Structure tVeight, kg (lb) 


kg (lb) 



Figure ? Structure Weight Correlation 



required in a system as a function of the increase in reliability. Data from 
these studies, which are presented in Section 3, were converted to weight 
factors for use in the synthesis program. Propellants and associated tankage 
weights were also increased as design life increased. Fui this study, design 
life was set to equal 1 . 8 X MMD. 

On-orbit maintenance of payloads was accomplished by incorporating 
replaceable modules in the payload design. This feature is accomplished 
within the synthesis program by applying factors to the appropriate subsys- 
tems. These factors were developed from design analysis conducted during 
the study as follows: 


Subsystem 


Factor 


Structure 

with fewer than 8 modules 
with more than 8 modules 
Electrical Dist. and Conditioning 
Thermal Protection 


0,1143 + 0.8857 

0.0875 + 1.10 

19.7 
1.10 


where: 

^m “ Number of modules 

- Thermal protection subsystem weight, pounds 


A graph of the structural modularity factor is shown in Figure 2-4 
which shows the correlation of data supplied in Reference 2 and the design 
studies performed at The Aerospace Corporation. 

These weight equations are only applicable over a limited range. 
These limits are: 

Weight < 1000 kg (2205 lb) 

Electrical Power < 5000 watts 
Design Life <10 years 

Pointing Accuracy + 1.7 X 10“^ radians (0.01 deg) 
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Number of Module* Per Satellite 
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SYNTHESIS PROGRAM OPERATION 


The synthesis program prints d£.ta in tabular form. The first 
column lists the reference weights for a current-technology, expendable 
launch vehicle satellite. Weights are listed by subsystem. The second 
column shows the subsystem weights as the payload shape is modified to 
fit the Shuttle cargo bay. The third column delineates the subsystexr veights 
of a Shuttle -launched payload with retrieval and ground- refurbishability 
features. The fourth column presents the subsystem weights of a Shuttle - 
launched payload with on-orbit maintenance capability. The data are based 
upon the number of modules specified. The MMD variation effects are 
included in these three columns. Adapter weights are also provided. A 
typical computer run would include weights for a large variety of parametric 
values. 

C. SAMS SYSTEM OPTIMIZATION 
1 . INTRODUCTION 

The prime objective of the Steady State Availability of a Modularized 
System (SAMS) optimization analysis is to determine the frequency of Shuttle 
laimches required to establish the maintain the payload complement in orbit. 
It is desired also to determine module usage rates and to assess the payload 
operational availability. The technique of simulation was selected as opposed 
to the closed-form approach because of the complexities involved in the 
analysis. Complexities such as non -homogeneous and non -exponential mod- 
ules, launch strategies based on warnings as well as on failures, and repairs 
or renewals based on various degrees of predictive information are all 
readily analyzed by the simulation technique but are extremely difficult in 
the closed-form approach. 

The simulation is Monte Carlo in that repeated trials of Shuttle 
operations are simulated in order to obtain the ensemble averages or other 
properties of the simulation. Briefly, the payload module failure times are 
generated at random according to their individual reliability functions, and, 
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depending on the launch and renewal strategies used» the failed modules 
together with other possibly degraded modules are repaired by generating 
new failure times for these modules. The simulation also considers whe- 
ther the satellite is the expendable type» retrievable type, or on-orbit 
maintainable type. 

The major inputs to the SAMS simulation are the module reliability 
functions. Each module has associated with it a Weibull reliabilil, fm. > ion 
of the form: 

-(-f 

R(t) = e '®' . 0<t^r 


where: 

a is a scale parameter having units of time 
P is a non-dimensional shape parameter 
T is the module truncation time. 

The module reliability functions are obtained by first optimizing the payload 
redundancy using the System Optimization (SYSOPT) computer program, 
then assigning the various components to specific modules, and, finally, 
computing the Weibull reliability f\inction for each module. Also considered 
are warning functions which are modelled by Weibull functions. The warn- 
ings are used primarily in the selection of non-failed modules to be loaded 
on the Shuttle for on-orbit repair. 

Thre*^ methods of generating the pair of warning and failure times 
can be simulated. These methods are described in detail in the following 
section on Program Inputs and Life Simulation Methods. The methods 
depend on the definition of a warning and its relation to a failure • The 
simulation can, however, be used without considering the concept of warning. 

The method of selecting the order of modules to be loaded on the 
Shuttle is an important concept in the simulation. The replacement order 
assumes failures first, then warnings, and, finally, if additional loading is 


19 



possible, selection of the additional modules based on using one of several 
predictive modes. In the predictive mode, a priori tagged modules are 
selected first, but untagged modules are never selected. In the random 
predictive mode, all remaining modules have an equal chance of being 
selected. In the perfect-failure-prediction (PFP) mode, the selection is 
made in increasing order of generated future failure times. In the condi- 
tional life mode, the selection is made according to the median value of 
their remainng lives. There are also other modes possible, depending on 
how much telemetry information is available, but these tend to be a compro- 
mise between the PFP and the conditional life modes. 

The simulation as developed is described in Reference 3 and pro- 
vides an efficient basis for performing complex replensihment analysis 
(involving the design as well as operational parameters) of both the Shuttle/ 
Tug and payloads. The following sections provide general information on 
the SAMS program. 

2. GENERAL SIMULATION CONCEPT 

The primary purpose of the simulation is to obtain the following 
output parameters. 

a. Payload availability 

b. Payload module usage 

c. Shuttle launch rate 

These output parameters are described later in this section. 

A typical Shuttle service simulation is shown in Figure 2-5. Two 
service actions are illustrated in the figure: the first can be a delivery- 
retrieval operation, and the second an on-orbit repair operation. In this 
case, the on-orbit repair operation can include both the repair of a failed 
module and the repair of degraded modules. 

The simulation involves the establishment and maintenance of a 
four -payload system on orbit. The simulation assiimes that the payloads 
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Figure 2-5. Simplified Illustration of Shuttle Service Simulation 
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are established in specified orbit positions at fixed launch times (the 
establishment mode) and that the maintenance mode begins after all the 
payloads have been placed on orbit. An establit?hment failure due to a 
launch failure or an early payload failure calls for servicing in the mainte- 
nance mode on a first failed-first served basis. 

Each payload is assumed to be module ..sred with associated weight 
and reliability parameters. In addition to payload and module weights, SAMS 
considers the Tug performance parameters and the payload orbit parameters 
in order to arrive at "best" service loads for each launch. A "best" service 
load is the maximum total payload and module weight that the Tug can carry 
for each launch, consistent with the .enewal strategy I’.sed.’^ 

The "heart" of the simulation involves the module reliability 
functions which determine the life values of the modules. The module 
reliability functions are established using the SYSOPT computer program, 
and are discussed in >he next paragraph. The method of simulating life 
values is described later in the section. 

3. SYSOPT COMPUTER PROGRAM** 

System Optimization (SYSOPT) is a Fortran computer program 
which takes any satellite reliability configuration and adds redundancies at 
the component (or black box level) to increase the MMD of the total system. 
The computer program systematically adds a redundant component, includ- 
ing expendables, one at a time for the greatest increase in MMD per unit 
weight. The candidate giving the greatest MMD/A weight ratio is selected 
for the additional redundancy. The computer program repeats the process 
of selecting redundancies until: 

a. A maximiun weight is reached. 

b. The greatest MMO/A weight is less than 10~^ 
hours/kilogram. 

c. 200 iterations have been completed. 

* In this study, only a single payload service was assumed. 

** This program was not developed in this study and is described in this 
report for completeness only. 
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At present, the types of redundancies in the computer program are 

sure * 

a. Active Redundancy 

All components are active, and only one operational 
component is necessary. Receivers are generally 
made active redundant. 

b. Standby Redundancy 

Only one component is active, and the remainder are in 
a standby mode. Thus, the failure rates of the standby 
components are reduced to reflect the passive state. 

A sensing and switching device is necessary to detect 
failures of the primary mode. Transmitters are standby 
redundant. 

c. Binomial Redundancy 

All n components remain active, and m components are 
required for nominal performance (msn). Batteries in 
the power subsystem are usually redundant in this manner. 

d. Normal Redundancy 

One component is active with failure described by normal 
density function. The failure rate of redundant components 
in the standby mode is modeled as zero in this study. 
Expendables are generally treated in this manner. 

The information required to use the computer progreun is a list 
of con>ponents by subsystems which comprise the satellite system. For 
each component, the data needed are; 

a. The components in the initial configuration 

b. The maximum number of redundancies permissible 

c. The type of redundancy and the minimum required 
in the case of the binomial redundancy 

d. The duty cycle of the active component 

e. The weight o^ each component 

f. The added weight when the first rediindancy is added 

g. The active and standby failure rates (For the normal 
Redundancy model, these are the mean and standard 
deviation.) 
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The SYSOPT output identifies the subsystem and component and 
shows the quantity of components in the initial and final configuration as 
selected by the computer program. The output also identifies at each state 
(or iteration) the component selected for redundancy. Included in the output 
data are: 

a. The state (or iteration) 

b. The identification of the redundant component by number 
(The components are numbered consecutively.) 

c. The total number of redundancies of that particular 
component 

d. The total weight of the satellite system 

e. The time t used to calculate MMD (which is a function 
of the expendables aboard) 

f. The MMD of the total system 

g. The reliability of the total system at the time t 

4. PAYLOAD STATE CONCEPT AND AVAILABILITY 

A payload is in an "up" state if all its modules, including its house- 
keeping modules and experiment modules, are operational or in non -failed 
states. A payload is in a "down" state if any of its modules is in a failed 
state. In the SAMS computer program, the state change time points of each 
payload are stored for each Monte Carlo trial. A Monte Carlo trial is a 
typical mission simulation starting at time zero and endi'^g at some pre- 
scribed time. For each Monte Carlo trial, .SAMS keeps track of the state 
change time points and sums the individual up times from a prescribed 
"availability start time" (TA) to the simulation end time (TM). For each 
Monte Carlo trial we have P/L I: 

0^ = mean up time in trial i for P/L I 

( 1 ) 

NUi(I) 
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where 


U|j (I) - up time in trial i for P/L I 

NU^(I) = number of up times in trial i for P/L I 


A^(I) = availability of P/L I in trial i 

^ NUi(I) 

"" (TM-TA) ^ U..(I) 

j = l 

It should be understood that the up time or availability of P/L 1 is 
the up time or availability of the function associated with P/L I* A deploy- 
ment and retrieval of P/L I is assumed to take place in the same orbital 
position. 

The above statistics apply to a single Monte Carlo trial. In order 
to obtain statistical confidence, a number of trials must be made to obtain 
the ensemble outputs. 

Comparable measures can also be defined for total system avail- 
ability where the total niunber of payloads is considered, and the availability 
can be generally defined in terms of a subset of payloads. For the total 
system, the quantities analogous to equations (1) and (2) can be an out- 
put. 

5. LAUNCH AND MODULE USAGE RATES 

The previous subsection was concerned with the availability per- 
formance parameters A (availability) and U (mean up time). Equally or 
more important are the cost impact parameters of launch and module usage 
rates. For each Monte Carlo triel i, SAMS accumulates the number of 
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failures over the simulation interval TM resulting from anomalous events in 
module J of P/L 1. The ensemble statistics for the Monte Carlo trials are: 


NF(1, J) = Number of failures resulting 
from anomalous events in 
module J of P/L I 

( 3 ) 


1 

MC 



NF.(I.J) 


NF (I, J) = Number of failures resulting 
from anomalous events in 
module J of P/L I for i^^ trial. 


SF(I,J) = Standard deviation of NF^(I, J) 


1 

MC 


MC 1^/2 

NFf(I.J)-NF^(I.J) 
i=l ^ 


( 4 ) 


A typical Shuttle launch can involve the replacement and retrieval 
of an entire payload and also the servicing of multiple modules within a pay- 
load or payloads. For each Monte Carlo trial i, SAMS accumulates the niim- 
ber of launches resulting from anomalous events of any module. The total 
nximber of launches resulting from anomalous events is summarized by the 
ensemble statistics. 

6. PROGRAM INPUTS AND LIFE SIMULATION METHODS 

These paragraphs describe the reliability inputs to the simulation 
and the m hods of simulating module life. Also described are the following 
general inputs to the simulation: 

NS = Number of payloads to be established and maintained 
on-orbit 

TM = Simulation time of mission interval 

NF = Number of failures required for a Shuttle launch 
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MC Monte Carlo sample size 
RSTRT = Random number start value 


^L1 ” Launch reaction time for on-orbit repair launch 

^L2 ” Launch reaction time for ground- refurbishment launch 
- Repair time on-orbit for each payload 

Rj^ = Launch reliability (Failure mean.« ^ second attempt is 
made 

R^^ = Docking reliability per payioud (Docking failure aborts the 
repair mission for subsequent payloads but does not 
require an immediate new launch if there are no unre- 
paired failures.) 

R^ = Repair reliability on-orbit per payload (Unsuccessful 
repail requires an immediate new launch.) 

The payload module reliabilities are the primary input to the simula- 
tion because they determine the launch rate of the Shuttle. The module relia- 
bilities are modeled by Weibull functions^ because the Weibull is the simplest 
generalization of the exponential and has the flexibility of considering decreas- 
ing as well as increasing hazards. The warning functions are also modeled 
as Weibull. In the simu'^tion, any failure triggers a launch, and it is 
assumed that warnings are not involved in the launch decision; however, 
warnings which have occurred at the launch decision point have priority in 
determining the orbit service load. The order of module selection for serv- 
ice of occurred warnings is ordinarily based on a first event - first served 
basis, but it is possible to modify this order by some weighting scheme. 

A weighting scheme is the reciprocal mean life of the module where a module 
with a large mean life can be pushed back in the priority order. The result 
is that a module pushed back in the order may not be loaded until the nexc 
Shuttle launch. The simulation currently assumes that the first payload 
visited is the failed payload, and subsequent payload service ordering is 
based on the order prescribed by the separation angle; i.e., the exact warn- 
ing ordering or predictive ordering scheme used in determining the Shuttle/ 
Tug load is generally overridden by orbit geometry consideration in order 
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for the flight to carry as much lead as possible. Accumulated failures » 
however, are serviced first, Aiso, all service called for by the priority 
ordered loading for a partic^^iar payload (failed and warned modules) are 
serviced in one visit. 

7. MODULE LOADING (SERVICE) ORDER 

The previous subsection described the methods of simulating or 
generating warning and failure times for a selected module. This subsecti^*^ 
describes the methods of selecting the order of modules to be loaded on the 
Shuttle/ Tug. As mentioned previously, a launch is based on a failure ?nd this 
failure (first failure first if there is an accumulation) is to be serviced first 
before other modules selected for servicing. Assuming additional modules 
can be loaded, servicing of occurred warnings is usually the next corsidera- 
tion on a first event - first served basis. After loading the Shuttle with these 
modules, assuming that additional modules can be loaded, the selection is 
next based on a predictive mode. 

The priority order may be summarized as follows: 

a. Load failed module replacement first. If there are 
accumulated failures, load the modules on a first failed - 
first served basis. 

b. After completing the loading of fax.. ?ie replacements, 

select further modules from occurred warnings on a first 
event - first served basis or on some modified ordering of 
occurred warnings. 

c. If still further loading is possible, seioct seivice modules 
based on a predictive mode. 

The logic implemented to select the module loading order for pre- 
dicted failure replacements is that certain modules can be tagged to be 
selected first (in order of tagging) in tiie predictive mode. Other modules 
can be un tagged and never selected in the predictive mode. After selecting 


The assiimption of servicing failures first may be changed at a later date. 
This assumption is made in view of the fact that outage occurs only for 
failures and not for warning and also because the relaxation of this assump- 
tion opens the door to a tremendous range of ordering methods. 
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the tagged modules and assuming that still further modules can be selected 
for service, SAMS selects the modules according to the following options: 

a. Random or no failure information mode. Order unwarned 
and \mfailed modules on the basis of a random ordering 
where all possible orderings are equally likely. 

b. Perfect failure prediction or PFP mode. Other modules 
in increasing order of actual generated failure times. The 
failure time of each module is accurate!'; predicted. 

c. Conditional life mode. Order modules in increasing order 
according to their 50 percentile conditional life value In 
the computation, the operational time of the module taken 
into account. 

The PFP mode considers the accurately generated failure times 
whereas the conditional life mode considers the failure distribution function. 
None of the three predictive modes considered is concerned with warning; 
thus, warnings only enter into the simulation as events which have occurred 
prior to a launch -triggering failure. This is appropriate, because predic • 
tion of a v'^arning is of less concern than the honoring of a warning that has 
occurred and thus, when a prediction is necessary, the prediction should 
be for the failure event rather than for the warning event. 

D. LAUNCH AND PAYLOAD SERVICE RATES 


The expected number of launches that were computed in the pre- 
vious subsection is used to determine the Shuttle launch and payload service 
rates. This data is required to evaluate the trip charges and the ground- 
refurbishment and on-orbit maintenance charges. 

The Shuttle launch cost can be shared with other missions on the 
flight since the Orbiter and Tug can perform other operations such as deploy- 
ment, servicing, and retrieval and return of payloads. The amount of sharing 
will depend on the performance capability. In the case of the Shuttle/Tug, 
the performance is limited. Performance was not considered in the case of 
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the Shuttle only, because there was adequate deployment and retrieval 
performance capability for the payloads considered in the study. 

For the Shuttle/ Tug, the performance capability was based on the 
values provided in Reference 4 which are listed as follows for payload place- 
ment into synchronous orbit: 

Round Trip = 1360 kg (3000 lb) 

Retrieve and Return - 1910 kg (4210 lb) 

Deployment = 3620 kg (7980 lb) 

These performance limits were used to determine the trip sharing based on 
payload weights. For the payload weight range of W < 1360 kg (3000 lb), the 
expendable payloads were assumed to share the trip with another payload, 
but a ground- refurbishable payload was not shared because the Tug is per- 
forming a round-trip operation by deploying a payload and retrieving and 
returning another payload. For payloads in the weight range of 1360 kg 
(3000 lb) < W ^ 3620 kg (7980 lb), the expendable payloads were assumed 
to be a dedicated flight. For ground- refurbishable payloads, the payload 
weight range was limited to 1360 kg (3000 lb) <W < 1910 kg (4210 lb). Two 
dedicated trips are involved, because one trip is required for deployment 
and a second trip is required to retrieve the ground -refurbishable payload. 
The ground- refurbishable payload weight cannot exceed this limit in order 
foA the payload to be returned for refurbishment. 

For on-orbit maintenance payloads, the Shuttle/Tug must be capa- 
ble of servicing non -space- replaceable components and on-orbit replaceable 
modules. The repair of non -space- replaceable components must be accom- 
plished by returning the payload to ground. Thus, the payload weights for 
one trip charge must be limited to W ^ 1360 kg (3000 lb). The repair of 
on-orbit replaceable modules was assumed to be accomplished by a servic- 
ing unit adapted to the Tug to house the modules and to remotely changeout 
modules. This servicing unit ard maneuvering impulse to service the second 
payload were assumed to weigh 454 kg (1000 lb) which leaves 908 kg (2090 lb) 
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for modules* The module loading capability^ if two payloads are serviced^ 
is ^ 454 kg (1000 lb). If the module weight exceeds this limit, the 
maintenance mission would service only one payload and the added maneuver- 
ing impulse would not be required. The module loading capability for this 
case is then 454 kg (1000 lb) < < 1130 kg (2500 lb). If the module weight 

exceeds this limit, the maintenance mission will require two trip changes. 

With these performance constraints, the equations to determine the 
launch rates for the Shuttle/ Tug and payload including the servicing were 
then formulated. These launch rates and payload service rate equations are 
summarized in Table 2-2 for three payload types. For all of these cases, 
it was assumed that the last payload in the replacement/service series 
remains on-orbit after the mission has been completed and that the last 
ground- refurbishment payload or modules are returned to avoid debris in 
space but are not refurbished on the ground. Also, one spare payload was 
included for the ground- refurbishable payload, one set of replacement 
modules was included for an on-orbit maintenance payload, and no spare 
hardware was included for expendable payloads. These equations are limited 
to a one-payload system; i.e«, they do not apply to a multiple -payload system 
on-orbit. The equations were programmed as a subroutine in the payload 
program cost model to provide equivalent launch rates for trip charges and 
payload service rates for ground- refurbishment and on-orbit maintenance 
charges. 

E. PAYLOAD PROGRAM COST ESTIMATING 
1 . INTRODUCTION 

From past payload studies, a comprehensive payload program cost 
model has evolved for analyzing a total space program composed of numerous 
individual payload (satellite) programs. This basic cost model has been 
simplified and reprogrammed for a remote terminal computer system that 
allows individual payload programs to be modified and analyzed quickly and 
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Table 2”2. Shuttle/Tug Launch and Payload Rate Equatioi 
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Ratio of number of modules replaced to total number of modules in payload 
Program duration 



efficiently. Subroutines have been added to the program so that the lowest 
total program cost can be automatically identified from among a large num- 
ber of alternative design and program strategies. The purpose of this sub- 
section is to: 

a. Provide a description of the basic cost model 

b. Define the inputs it requires 

c. Discuss the output of the model 

2. PAYLOAD PROGRAM COST MODEL 

The model is composed of two major sections; one computes satel- 
lite costs and the other computes launch vehicle cost. For the Shuttle/Tug, 
launch vehicle cost is defined as direct cost per iiight and includes such items 
as expendable drop tanks, pro-rata solid motor hardware, propellants (solid 
and liquid), recovery, refurbishment, spares, and launch site vehicle mainte- 
nance and flight support. 

Payload cost is defined as all effort required to design, develop, 
and manufacture satellites and support them during launch and orbital opera- 
tion. Typically, a satellite program is divided into RDT&iE (nonrecurring), 
investment (recurring), and operations (recurring) cost categories, and the 
model treats each cost estimate accordingly, RDT&tE covers design and 
development, investment includes procurement of satellite hardware, and 
operations covers support during and after launch. In cases where reuse 
through ground refurbishment or on-orbit servicing is considered, the opera- 
tions category also includes repair and refurbishment. 

The basic payload model calculated RDT&E and unit cost from pay- 
load data that are automatically applied to cost-estimating relationships 
(CERs) stored in the program. Launch vehicle cost information is a direct 
input. Based on payload and launch vehicle quantities, satellite unit and 
program total costs are calculated and printed for each alternative. 

The payload computer model has been modified to aid in selecting 
lowest-cost alternatives from a wide range of performance and program 
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variables. The categories of variables that affect cost are type of satellite 
(expendable^ ground refurbishable» on-orbit maintainable^ or Sortie), num- 
ber of replaceable modules per payload, MMD (which is reflected in weight 
differences from the baseline payload), number of modules replaced per 
visit, numerous cost sensitivity candidates (such as launch costs, ground 
refurbishment rates, or on-orbit servicing rates), and program lifetimes. 

Inputs are obtained from the Spacecraft Synthesis and the SAMS 
programs, which provide payload and schedule (quantity) data. These data 
were manually inputted to the payload model; however, the model is 
organized so that all estimates covering all of the variable mentioned above 
are calculated, and the lowest -cost alternative is identified for each 
category. 

3. COST MODEL INPUTS AND ASSUMPTIONS 

The performance data and the payload descriptive and schedule 
(quantity) information required for operating the cost model are set forth 
in Table Z-3. Descriptions of all inputs and the necessary assumptions that 
relate to their use are presented in this section. In addition, the following 
basic assumptions apply to the cost estimates generated for this study: 

a. Constant 1973 dollars used 

b. No low-cost designs considered; i.e., those based on 
relaxed weight and volume constraints 

c. Standardized modules not considered; therefore, no savings 
accrue from shared developments or quantity production 

d. Complete RDT&:E costs included for each satellite alterna- 
tive, except that, for reusable satellites, one equivalent 
set of payload parts and 75 percent of mission equipment 
RDT&E are used to estimate effects of shortened R&D time 
and cost when the Shuttle system is used 

e. Sortie mode user charge is $0.7 million per flight based 
on MSEC data; no Sortie RDT&E is charged. Only one set 
of mission eq\xipment is used 

f. No payload infant mortality is included; however, all other 
reliability effects are included in yearly expected flights 
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Table 2- 3. Satellite Cost Estimate - Basic Input Information 


Input Item Description 

Title 

Satellite type 

Structure weight 
Electrical power weight 
Communications weight 
Stability and control weight* dry 
Stability and control weight* consum. 
Propulsion weight* inerts 
Propulsion weight* propellants 
Mission equipment weight 

Mission equipment type 

Initial electrical power 
Propulsion* type 

Propulsion* total impulse* Ib/sec 
Orbit altitude 

Number of satellites in system 

Constant year dollars 
Launch vehicle type 
Schedules (quantity) 

Structure type 

Stability type 

Refurbish rate 

(for ground refurbishment) 

Repair rate 

No. of replaceable modules/ 
payload 

No. of modules replaced/visit 
Launch vehicle cost ($ million) 


Examples (or Remarks) 

(Six-digit number for identification) 

Expendable* on-orbit maintainable* 
ground reusable* and Sortie 

(Baseline expendable weights by 
subsystem- -when satellite is 
different from baseline* then 
non-baseline weights must also 
be an input. ) 


Communication* earth resources* 
etc. 

Watts 

Solid or liquid* if subsystem needed 

If subsystem needed 

Low* sync. * planetary 

(Required in orbit for system 
operation) 

1973 

Shuttle or Shuttle /Tug 

(Quantity based on yearly expected 
flight requirements 

Exostructure or endostructure 

3 -axis or spin 

39 percent 

25 percent for one equivalent 
satellite's worth of modules 

2 to 19 in a satellite 

One to all per flight 

Shuttle is 10.3; with Tug* 11.2 


35 






g. Ground refurbishment based on replacing non-repairables, 
e.g., batteries and propellants; repair of failed items; and 
complete production acceptance test of all replaced parts 
and modules 

h* One RDTiiiE for program duration 

i* Total program cost based on slice of continuing program, 

i.e., residual value is not included 

a. Title and Satellite Type 

For identification purposes, a six-digit number is used as a title 
for each satellite program alternative. Each digit represents a different 
category of alternatives: 

1. The first digit represents the type of satellite; i.e., 
expendable, ground refurbishable, on-orbit maintainable, 
or Sortie. Expendable refers to typical current designs 
that assume expendable satellites. Ground refurbishable 
means that current technology and design procedures are 
used but that they are modified to allow for reuse. On-orbit 
maintainable payloads have space-replaceable modules and 
non-space-replaceable components. Sortie payloads assume 
that mission equipment is flown in a Sortie Lab at low orbits 
for short periods of time and then returned to earth. The 
digit will be 1, Z, 3, or 4 depending on type. (Similarly, 
the digits below will vary from 1 to 9 depending on the num- 
ber of alternatives in each category. ) 

2. The second digit defines the number of replaceable modules 
in a particular reusable satellite design. The number of 
modules will vary from 2 to more than 20. 

3. The third digit defines the MMD, which varies from 1 to 
4.5 years for the cases considered in this study. 

4. The fourth digit defines the number of modules replaced 

per visits depending on the number of modules in a particular 
design. The modules replaced will vary from one to all. 

5. The fifth digit defines repair rates for ground or on-orbit 
serviced alternatives. 

6. The sixth digit defines launch vehicle cost (trip charges). 
Program lifetimes are varied for all of the above alternatives but are not 
identified by a separate digit. 
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b. Subsystem Weiuhts 


Expendable weights are an input, because the cost -estimating 
relationships (CERs) are based on typical expendable satellites. Factors 
are applied to the baseline cost estimates to provide for ground- refurbishable 
or on-orbit maintainable designs. The factors are based on differences in 
weight from baseline subsystems and thus require additional weight input 
data. 

c. Mission Equipment Type 

Ten types of mission equipment are identified in the cost model: 

1 . Communications 

2. Navigation 

3. Earth Resources 

4. Meteorology 

5. Surveillance 

6. Technology Applications 

7 . Astronomy 

8. Plasma Physics 

9. Solar Observation 

10. Planetary 

For a particular estimate, the most appropriate category must be selected 
from the list. 

d. Initial Electrical Power 

Input requires initial output of the electrical subsystem to be given 

in watts. 

e. Propulsion Type and Total Impulse 

A propulsion system is not normally required by most satellites; 
however, such a requirement should not be confused with the attitude control 
propulsion, which is part of stability and control. The Type refers to the 
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propellant used^ either solid or liquid. Total Impulse in kg/ sec (lb/ sec) is 
also a required input when a propulsion subsystem is needed. 

f • Orbit Altitude 

The orbital altitude at which the satellite operates is a required 
input. Three categories are considered: low, synchronous, and escape 
(planetary). 

g* Number of Satellites in System 

Many programs require more than one satellite to be in orbit dur- 
ing operations; quantity required is a needed input. 

h. Constant Year Dollars 

Cost estimates reflect constant dollars, as desired by a particular 
analysis, and provision is made for such an input. 

i» Launch Vehicle Type 

The cost of launch vehicles is set in the program; however, the 
Shuttle or the Shuttle/Tug must be identified by an input. 

j. Schedules (Quantity) 

The SAMS program generates yearly expected launches for each type 
of satellite and for each strategy. These yearly expected values, together 
with the program lifetimes which are used in the computer to calculate 
quantities of payloads launched and number of launch vehicle flights required, 
were described previously. 

k. Structure Type 

Type of structure refers either to endo structure (associated with 
compact, spin-stabilized satellites) or exostructure (associated with less 
compact, three-axis -stabilized satellites). 

l. Stability Type 

The stability systems may be either spin or three-axis controlled. 
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m. Refurbishment Rate 


The refurbishment rate does not apply unless the satellite is ground 
refurbishable . The rate, when applied to the average unit cost, gives a cost 
per flight of repairing and refurbishing a satellite that has been returned 
from orbit. Nominal rate is 39 percent; for sensitivity analyses, 50 percent 
and 30 percent are used. Sortie is three percent per ilight applied to mission 
equipment only. 

n. Repair Rate 

Repair rate applies only when a satellite is designed for on-orbit 
maintenance. The comp-.^er program calculates servicing cost based on 
the number of replaceable modules carried to orbit, the number of modules 
that make up the satellite, and the average repair rate. The nominal rate 
is 25 percent; for sensitivity calculations, 30 percent and 20 percent are 
used. 

o. Number of Replaceable Modules Per Satellite (and Per Visit) 

Depending on the servicing strategy, one or more modules will be 
carried to an orbiting satellite when a failure occurs or a warning system 
demands a repair flight. 

p. Launch Vehicle Cost 

Any launch vehicle can be considered; however, this study uses the 
Shuttle, Shuttle/Tug, or Shuttle/Sortie Lab; costs are $10.3 million based on 
NASA/MSFC inputs, $1 1 . 2 million, or $1 1 . 0 million, respectively. The Tug 
rate is $0.9 million, and the Sortie Lab rate is $0.7 million. 

4. REDUNDANCY AND MODULARITY 

Previous satellite studies on extended sign life (Air Force Pro- 
grams 191 and 777) have examined the effect on subsystem weight and cost 
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of extending satellite lifetimes through redundancy. Factors were 
developed that equated subsystem weight increases with cost increases 
for redundant equipment. As part of the current study, additional work 
has been done on the DSP satellite, and the results have oeen integrated 
with the previous studies. As a consequence, adjustments were made to 
the communications and mission equipment subsystems; however, no 
change to electrical or stability and control subsystems occurred. 

The actual calculation is based on comparing a particular design 
with the baseline, establishing a weight change factor, determining the cost 
change factor from the weight factor, and applying the cost factor to the 
baseline cost estimate. The Payload Program Model automatically com- 
putes the required factors and applies thr m to the RDT&iE and unit cost 
estimates. 

Similar methods are used by the model to give effect to modularity 
for on-orbit serviced designs; however, structure cost is based solely on 
cost estimating relationships (CERs). In addition, the number of modules 
in a particular design influences the cost of stability and control. Again, 
the computer model makes all of the required calculations based on the 
inputs discussed earlier. 

5. CER ANALYSIS 

Over the p >t several years, satellite cost data have been collected 

in an effort to verify the accuracy of cost-estimating relationships used in 
various payload- related studies. These data were assembled and compared 
with CER estimates; the conclusion was reached that the CERs gave reason- 
ably acceptable estimates. For this study, a more detailed analysis was 
conducted to gauge the effect on cost estimates of possible changes in the 
CERs. The method used for this analysis was to measure the approximate 
change in estimates of cost for a typical satellite. An average from the 
sample data for each subsystem was used as proxy for weight and perfor- 
mance inputs. Costs were then calculated from the original CERs and from 
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possible revised CERs,^ and a comparison of th^ results was made as 
shown below 


Subsystem 

Weight 

Total Cost in $ Millions 



Original 

CERs 

Revised* 

CERs 

Structure 

102 kg 1225 lb) 

10.2 

9.7 

Electrical 

300 (watt)’'"' 

11.2 

16.3 

TT&C 

57 kg (125 lb) 

26. 5 

2i . 2 

Stab, and 
Control 

68 kg (150 lb) 

27. 1 

25.7 

TOTAL 

75. 0 

72.9 


From the above set of figures, it can be seen that the difference 
between the previous CERs and a possible revision would result in a change 
of less than three percent. Based on this analysis, it appears that a major 
revision in payload CERs (including the substantial amount of effort such an 
undertaking would require) is not critical for this study. 


The CERs have not actually been revised; an approximation was used based 
on a best-fit representation of the actual subsystem cost data collected for 
all satellites in the sample. 

*^The electrical CER is based on power rather than weight. 
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3. DESIGN ANALYSIS 


A. INTRODUCTION 

Design analysis was performed on the Large Space Telescope (LST) 
and the Shuttle- Launch- d Defense Support l^rogram (SLDSP) to develop 
quantitative cost data. These co9ts were developed to reflect the effects of 
reliability, repair strategy, and payload type. This type of payload data 
required the parts counts of each subsystem, the overall design concept, and 
weight estimates. 

For both payload programs studied, che reliability analysis and 
conceptual design^ were performed simultaneously because of the study 
schedule. This approach was satisfactory sinct^ the study is to provide para- 
metric cost-trend data and not a point-design analysis. The reliability 
analyses examined payload configurations ranging from single string to maxi- 
mum MMD. The conceptual design task investigated varying numbers of 
modules in the payloads and different payload types. The design effort empha- 
sized on-orbit maintenance concepts for both low- altitude and high- altitude 
operations. The low- and high-altitude servicing is performed by the Orbiter 
and Tug, respectively, where each has different servicing approaches. From 
these independent efforts, the design factors related to reliability, modularity, 
and payload type were developed as input to the mathematical model. 

The costing effort in the mathematical model computed systemati- 
cally the total program cost for a range of pa/loa^. data and expected launch 
rates that were provided from the design ti*sk and reliability analysis. Cost 
data dependent on the various parameters were then variec determined ls a 
function of variations in program duration, repair cost, and trip charges to 
evaluate their sensitivity to the various payload parameters. As indicated 
earlier, the effort was not aimed at a point design but rather to find payload 
cost trends. 
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B. LARGE SPACE TELESCOPE DESIGN ANALYSIS 

The Large Space Telescope (LST) was selected as the low-altitude 
payload for the design analysis. The baseline version of the LST spacecraft 
is illustrated in Figure 3-1 and described in Reference 5. The baseline LST 
is man-tended and non-modularized. It is composed of three functional 
elements entitled optical telescope assembly (OTA)t scientific instrument 
package .P), and support systems module (SSML The OTA includes the 
optics, forward structure, sunshade, baffles, and systems for telescope 
thermal control alignment, and focus. The SIP consists of the scientific 
instruments, supporting optics, sensors, electronics, positioning mechanisms, 
and the structure located at the telescope focal region. Typical instruments 
are field cameras, UV and IR spectrographs, and polarimeters . The SSM 
includes the aft structure and the subsystems required to support the OTA/ 

SIP. The SSM also provides a docking structure for on-orbit servicing or 
retrieval by the Space Shuttle. The SSM is designed to be pressurizable to 
provide a shirt-sleeve environment for astronaut during equipment servic- 
ing. 

1. RELIABILITY MODEL 

The reliability block diagrams were constructed for the scientific 
i^'strument package, optical telescope assembly, and support systems mod- 
ules from the data supplied in Reference 5. Failure rates, duty cycles, and 
weights of individual components were determined from the LST preliminary 
and Phase A technical reports. In some instances where failure rate infor- 
mation was not available but a reliability number was shown for some time 
t, equivalent failure rates were determined for the equipment using the 
exponential assumption. Equipment considered to be unessential to success- 
ful operations were deleted in the optimization study. Figures 3-2 through 
3-6 shows the reliability block diagram of the LST. Tht following assumptions 
were made: 
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Figure 3-1. MSFC Large Space Telescope (LST) 
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Figure 3-2. LST Scientific Instrunieni P.-ick^jg 
Reliability Model (No Rrfliinf' in' 















Figure 3-3. LST Optical Telescope Assembly (OTA) 
Reliability Model (No Redundancy) 

































Figure 3-5. LST Electrical Powr r 
Reliability Model 





























a. All components were assumed not to reach their wearout 
points. Failure rates for standby units were assumed to be 
equal to one tenth the active failure rates. The switching 
mechanisms are accounted for in the standby redundancies. 

b. The control moment gyros (CMG) in the attitude control sub- 
system of the SSM are binomial redundant requiring a minimum 
of three. Each gyro is composed of several components in 
active and standby redundancies. A reliability curve was 
generated for a single CMG and was approximated by an expo- 
nential curve with an equivalent failure rate. This was required 
due to the limitations of SYSOPT. 

c. The digital processor assembly in the attitude control sub- 
system of the SSM contains the power supply, the control 
processor unit, and the memory modules in standby redun- 
dancies. Due to lack of detailed weight data, the digital 
processor assembly was treated as a single component with 
internal redundancies. A reliability curve was generated for 
the component, and a normal curve (p = 61,320 hr, tr = 24,528 
hr) was used to approximate the reliability. Redundancy of a 
component described by the normal failure distribution implies 
a standby failure rate equal to zero. 

d. The ERTS and Apollo transponders on the communications and 
data handling subsystem of the SSM have a backup mode of 
operation for the transmitters. Using a 30- percent duty cycle 
for the transmitters, a reliability curve was generated for the 
two transponders combined. An exponentail reliability curve 
was fitted to the original curve and the equivalent failure rate 
used for the failure rate of the combined transponders. 

e. For the optimization, no redundancies were added to the SIP 
and the OTA. 

The block diagrams with expendables for a year’s mission time and 
stripped of unnecessary redundancies were used as the starting system 
configuration. Expendables were added in amounts equal to three- month 
intervals with the weight of 10.4 kg (22.93 lb) being divided equally between 
the propellant and the accompanying hardware. 

The SYSOPT program that was described previously was used to 
determine the parts count as the MMD was extended. The system weight 
dependency on the MMD as the MMD was varied from the single string case 
to a maximum of 1 . 7 years is shown in Figure 3-'^, From this data, 0.5, 

1.0, and 1.5 year MMDs were selected for detailed tradeoff analysis. At 
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these MMOs^ the parts count and weight are shown in Tables 3-1, 3-2, and 
3-3 for the housekeeping subsystems* The component failure rates and the 
MSFC baseline configuration parts count are also included. The MSFC base- 
line MMD was estimated to be 1.25 years. The parts list for the mission 
equipment is shown in Tables 3-4 and 3-5; this equipment was not made re- 
dundant in this study. 

2. CONCEPTUAL MODULARIZED DESIGN 

Conceptual design was performed to identify and evaluate feasible 
modularized configurations of a Shuttle- launched Large Space Telescope (LST). 
The study provided conceptual configurations of the LST that were suitable 
for module replacement by means of the Orbiter-based remote manipulator 
and/or a hard-docked servicing module. The principal design ground rules 
were as follows: 

a. The modular LST design should be amenable to equipment 
replacement by means of the Orbiter operator- controlled 
remote manipulator (Ref. 6). 

b. In addition to the spacecraft subsystems complement, the LST 
instrumentation (Scientific Instrument Package) is to be 
replaceable in orbit. 

c. All modular LST configurations are to be unmanned and unpres- 
surized. 

d. Telescope energy may be time- shared by the scientific instru- 
ments. 

e. Subsystems and/or components of long-life expectancy; e.g. 
spacecraft structure and solar arrays should not require 
replacement. 

A number of modularized LST concepts were identified. These are 
illustrated in Figures 3-8 through 3-12. Several of the concepts are suitable 
for use with a DSP- type servicing module, and the remainder are specifically 
configured for equipment servicing by the Orbiter remote manipulator. 
Examination of the master equipment list (Tables 3-4 and 3-5) indicates that 
the LST subsystems and instrumentation can be contained in the volume 
provided by a vehicle 4.42 m (14. 5 ft) in diameter and approximately 2.44 m 
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Table 3-1* LST Stabilization and Control Subsystem 
Failure Rate, Parts List, and Weight 
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Table 3-4, L^T Scientific Instrunnent Package Subsystem 
Failure Rate, Parts List, and Weight 


vrsifiht 



5 






























































Table 3-5, LST Optical Telescope Assembly Subsystem 
Failure Rate, Parts List, and Weight 


Component 

Structure 

Optics 

Thermal Control 
Data Management 





Focus Sensors 

3.i02 
DC=. 02 

13 

28 

1 

Angle Sensor 

3,108 

9 

20 

2 



DC=. 02 




Dece.iter Sensor 

3,102 
DC=. 02 

16 

36 

2 

Diagnostics 

500 

24 

52 

1 



Figure Sensor 


DC=. 02 

10. 500 
DC=.02 

3.505 






66 

145 


6 

17 

38 


1 



DC=.02 

i. - - 




Primary Mirror 
Force Transducers 



38 

24 

Light Shield 

480. 5 

3440 

758 

1 

Aperture Door 
Assembly 

744. 4 

99 

217 

1 

Meteoroid Shield 

2.0 

532 

1171 

1 

Baffles 

6. 0 

292 

644 

1 

TOTAL 


4587 

10098 





















































































Fifjure 3-8. Modularized LST, Concept No. 










Figure 3-10. Modularis^ed LST, Concept No. 
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(8 ft) in length. Figure 3-8 illustrates a concept wherein the LST instrumen- 
tation and subsystems are contained in two separate decks 1.22 m (4 ft) in 
length. This concept could be utilized with either a SLDSP-type servicing 
vehicle or the Orbiter manipulator. In this concept, the equipment in the 
aftmost deck would have to be removed first in order to gain access to the 
instruments in the forward deck. This procedure would require the servicing 
vehicle to be designed with a two- position translation probe in order to change- 
out the spacecraft equipment and would also necessitate the use of two rotating 
elements or decks on the servicing vehicle in order to accommodate equipment 
and service the spacecraft. For these reasons, the concept of Figure 3-8 was 
rejected. 

The concept of Figure 3-9 utilizes one long deck and installs the 
equipment in the axial (parallel to the vehicle longitudinal axis) direction. In 
this design, the equipment modules are located tangentially around the peri- 
phery of the spacecraft. The design of Figure 3-9 is directly applicable to 
refurbishment by a hard-docked service vehicle. This concept could be used 
with the remote manipulator. 

Figure 3-10 illustrates another concept that does not require a two- 
position translation probe if used with a hard-docked servicing vehicle and 
which is adaptable to use with the manipulator. It was not considered to be a 
strong candidate concept due to its apparent weight disadvantage compared 
with the concept of Figure 3-11 and lack of noticeable design improvement. 

Figure 3-11 depicts a concept that could be used with the manipu- 
lator but which is incompatible with the equipment replacement mode of the 
hard-docked service vehicle. The basic (square) shape exhibited by this 
concept results in some wasted cargo bay volume. This is particularly 
objectionable in the case of a spacecraft such as the LST wherein some of the 
instrumentation is on the order of 1.83 m (6 ft) in length. For the se reasons, 
the concept of Figure 3-11 was not considered further. 

Figure 3-12 illustrates a concept that is well adapted for use with the 
manipulator as shown in Figure 3-13. A detailed discussion of this configura- 
tion and a comparison of this concept and the design of Figure 3-9 are presented 
in the following sections. 
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Figure 3-13. Swing Translation to Replace Module for 
On-Orbit Maintenance Using Orbiter RMS 






a. 


Comparison of Modular Concepts 


The two most promising modular LST payload concepts identified 
above are shown in Figures 3-9 and 3-12. The concept of Figure 3-9 illus- 
trates a configuration that is amenable to equipment replacement by means 
of a hard-docked service module. In this mode, the equipment modules 
would be removed and replaced in a (longitudinal) direction parallel to the 
spacecraft axis. The service module or compartment (containing the replace- 
ment modules) could be carried in the aft end of the Orbiter cargo bay and 
elevated to a suitable position for docking with the LST after opening of the 
cargo bay doors. 

Although the Orbiter-borne manipulator has the kinematic capability 
(travel and degrees of freedom) to replace equipment modules by movement 
in the payload axial direction, the length of a module that can be replaced in 
the axial direction by means of the manipulator is at present severely limited 
by the proximity of a payload to the Orbiter fuselage when the payload is 
docked to the cargo bay extensible docking port [O. 762-m(30-in. ) clearance] 
(Ref. 7). If it is assumed that this limitation may not ultimately exist (due 
either to future revision of the extensible docking port/Orbiter geometry or 
to incorporation of a more versatile serviceable- payload docking arrangement), 
the configuration of Figure 3-9 can be considered to be a candidate concept 
suitable for servicing by either a hard-docked ser/ice module or by the 
manipulator. 

The concept of Figure 3-9 stores the scientific instruments longi- 
tudinally around the periphery of the payload structure. The modules would 
be at least 1. 83 m ^6 ft) in length to accommodate the instrumentation. In 
this case, the module support structure would basically be in the form of a 
ring or shell approximately 2.44 or 2.74 m (8 or 9 ft) in diameter with the 
subsystems and instrumentation mounted external to the shell. The modules 
are designed to be removed in the axial (longitudinal) direction. 

The concept of Figure 3-12 is designed to permit radially outboard 
removal of the modules by means of the Orbiter manipulator. The instru- 
mentation length is accommodated in the radial direction. In this concept, 
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the module support structure would occupy the full 4.42 m (14. 5 ft) diameter 
of the allowable payload envelope. 

The design of Figure 3-9 probably reflects a payload weight that is 
lower than that of the “radial” concept (Figure 3-12) due to the smaller 
diameter of the payload support structure. This weight advantage may not, 
however, represent a critical selection criterion for a low-earth orbit pay- 
load due to the large low- altitude payload launch weight capability of the 
Orbiter. In this design, the instrumentation receives its input energy from 
the LST telescope via auxiliary folding mirrors which, together with the 
instrument complement, are external to t^^e spacecraft structure. This 
design therefore exhibits some potential light- sealing and contamination 
problems that are not present with the concept of Figure 3-12 wherein the 
instrumentation and subsystems are totally contained within the external 
structure. A second set of fold mirrors is required for the design of Figure 
3-9 in order to reflect the (already reflected) light energy from the telescope 
into the longitudinally- oriented external scientific instrument modules. This 
requirement would result in additional alignment problems and in additional 
losses due to light scattering that are not inherent with the design of Figure 
3-12. 

The concept of Figure 3-12 also provides a more efficient thermal 
design, since the internal modules are arranged in a configuration that more 
closely approximates a “conventional” satellite rather than an arrangement 
that exposes the mission equipment directly to the space environment. This 
results in its thermal provisions being more amenable to normal thermal 
analysis techniques and will result in lower weight penalties attributable to 
the thermal design. 

If a hard-docked service module were used to effect the module 
change- out for the concept of Figure 3-9, it would be necessary that a rotat- 
able structural ring approximately 2.74 m (9 ft) in diameter be provided in 
order to furnish the capability of module indexing and effect module extraction 
and replacement. Potential bearing design problems and problems associate J 
with module indexing and replacement tolerances that may arise due to 
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differential thermal loads have not yet been fully explored. Even though 
indexing would not be required if this configuration were used for module 
replacement by the manipulator, the other potential disadvantages noted 
_bove (light sealing, contamination, thermal, additional fold mirrors, 
necessity for revision of the Orbiter docking provisions, etc.) would still 
apply. Finally, the design of Figure 3-12 is superior to that of Figure 3-9 
from the viewpoint of space utilization, since the internal volume provided by 
the latter concept is essentially wasted. The concept of Figure 3-12 provides 
approximately 30 percent more volume for mission equipment per unit length 
of module than that of Figure 3-9. 

Consideration of the various geometric and subsystems aspects 
involved in the comparison of the subject concepts therefore indicates that 
the concept of Figure 3-12 exhibits most, if not all, of the advantages for use 
with the Orbiter-based manipulator. While the design of Figure 3-9 can be, 
as explained, amenable to use with either the manipulator or a hard-docked 
service module, it does not result in a ’’preferred” design when considered 
for use primarily with the Orbiter-based manipulator. On the other hand, 
the concept of Figure 3-9 is well adapted to module replacement of high- 
altitude satellites by means of a servicing vehicle in circumstances where 
the manipulator is unavailable. 

b. Payload Module Geometry 

Module replacement of low- earth- orbit maintainable payloads may 
be effected by the Orbiter manipulator system. There will be a dimensional 
tolerance range on the exact location to which the manipulator can rapidly 
and efficaciously move a module due to the inherent limitations of the (human) 
ope^’ator, the fits and clearances at the various joints of the manipulator, 
and end effector deflections and tip-off. It is desirable therefore to provide 
all possible module design features that can accommodate these circumstances 
and simplify the function of module withdrawal and insertion. 

A layout drawing (Figure 3-14) was made to assist in the identification 
of basic design features and equipment that should characterize a typical 
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module designed lor replacement by the manipulator. Consideration of 
module/ structure clearance provisions indicated by the manipulator handling 
-equirements suggests a design that provides the basic characteristics and 
generous engagement tolerances of a probe and drogue. 

This characteristic can be suitably approximated by a module base 
or equipment mounting plate whose sides arc machined to a slight taper. A 
module baseplate with sides tapering only one or two degrees will (depending 
on the module length) provide a minimum clearance of several inches between 
the leading edge of a module and the spacecraft structure when a module is in 
the process of being inserted into the structure. This feature can be expected 
to accommodate module handling tolerances and ease the task of module 
replacement. S:"^es of the module that would ultimately be in sliding contact 
v/ith structure can be provided with rub strips of teflon or other suitable 
material ot . wd. Ebcternal protuberances (for example, rollers) that 
could be damaged by inadvertent or premature contact with structure should 
be avoided. 

After the module has been partially inserted into the structure, a 
tapered pin centrally located in the leading (forward) face of the module can 
be caused to engage a tapered hole in the payload. The pin wou dso serve 
to provide a power and ground connection for the equipment located on the 
mounting plate. The central location of the pin will serve to protect it from 
handling damage after the leading eoge of the module is initially inserted into 
the payload. A chamfer or "countersunk'* surface can be provided at the 
entrance of the (pin) receptacle so that the pin ard receptacle will always 
become engaged, evei if the module is off to one side of the (receiving) 
structure during insertion. Suitable cimensioning (reduction in or removal 
of taper) at the trailing edge of the module can make the module essentially 
self- guiding in this area and provide a close fitting "seat" between the module 
and spaceframe when the module is fully inserted. 

3. MASS PROPERTIES 

Tae LST mass propei,.ies were primarily ’'ased on part counts from 
the SYS'J V program. The SYSOP I provided part counts to determine weight 
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growth with MMD for the subsystems that are represented in the reliability 
model. These consisted of the stabilization and control; communication, data 
processing, and instrumentation; and electrical power subsystems. The 
structures and environmental control subsystems were not included in the 
reliability model. 

Since the structure was not included in the SYSOPT program, it was 
estima«.ed from design studies. The expendable payload structure weight was 
based on Reference 5 (structure weight = 0. 118 x equipment weight). The 
ground- refurbishable structural weight was estimated by increasing the 
structural weight for accessibility by factoring the expendable structure by 
1. 10. The structure weight for the on-orbit maintainable payload was based 
on design studies which are shown in Table 3-6. The payload consists of a 
basic spaceframe with 24 slots to accommodate space- replaceable modules; 
however, only 22 modules were required to package the parts. 

The total LST weights for the expendable, ground- refurbishable, 
and on-orbit maintainable payloads are shown in Talles 3-7, 3-8, and 3-9, 
respectively. The reference weight is the man-tended version that is 
described in Reference 5. 

The spacecraft synthesis program was not used, because the LST is 
a special type of payload that is not represented by the weight equation. The 
LST mission equipment weight is over 50 percent of the total weight, whereas 
the satellites used in the weight equations were generally around 15 to 20 
percent of the total satellite weight. 

4. MODULE SIMULATION PROGRAM 

The parts for the three MMD configurations that were described in 
the Reliability Model section were allocated to 22 of 24 available modtiles 
provided by conceptual design. The parts were ordered by subsystems, 
assemblies, or components so that each module will contain equipments based 
on function criteria. The size and weights were the limiting factors in the 
decision-making process in the amount of parts in each module. Using this 
approach, the parts were assigned to the mod lies as shown in Table 3-10. 
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Table 3-6, LST Structural Weights for 

On-Orbit Maintainable Payload 



MMD 

0. 5 

yr 

1.0 

yr 

1. ‘ 

yr 

kg 

lb 

kg 

lb 

kg 

lb 

Basic Structure 

182 

400 

185 

406 

192 

422 

Module Tracks 

262 

576 

262 

576 

262 

576 

Base Plates 

391 

860 

391 

860 

391 

860 

Mechanism 

136 

300 

136 

300 

136 

300 

Equipment Supports 

68 

150 

68 

150 

68 

150 

Miscellaneous 

386 

650 

388 

854 

392 

864 

Total Structure 

1,422 

3, 136 

1,427 

3, 146 

1,439 

3, 172 
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Table 3-7. Shuttle- Launched LST Weight, Expendable Payload 
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Table 3-8. Shuttle- Launched LST Weight, Ground- Refurbishable Payload 
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Launch Weight 8386 18483 8265 18223 J 8397 18503 8694 19162 




























Table 3-9. Shuttle- L.aunched I^ST Weight, Or-Orbit Maintainable Payload 
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Table 3-10. LST Space-Replaceable Module Characteristics 
for a 24-Module Concept 
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Table 3-10. i^ST Space-Replaceable Module Characteristics 
for a 24-Module Concept (Continued) 
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The space-replaceable modules number is schematically shown in Figure 
3-15. The aft deck has modules 1 through 12, and the forward deck has 
modules 13 through 24. Module nvimbers 13 and 19 are without parts in this 
example case but are available to accommodate future modifications. 

With the parts assigned to the modules, the reliability character- 
istics of each module were computed. The Weibull functions were then 
determined for each module and are shown in Table 3-10 for the three MMD 
configurations. The MMD of each module is also included to indicate the 
modules with low reliability which are the thrusters and solar power in the 
housekeeping subsystems and in a pseudo fashion, the expendables. 

Since the Weibull function is a best-fit of the predicted module 
reliability, it is of interest to examine the comparison. This comparison is 
made in Figure 3-16 for space- replaceable module No. 1. It indicates that 
the fit is relatively close to the module predicted failure. At the system 
level, when all of the modules are included, the fit is better. This can be 
seen in Figure 3-17, where the one-year MMD configuration is a near dupli- 
cation of the predicted reliability; however, a departure is noted beyond the 
design MMD. 

With the Weibull functions determined for each module, the expected 
numbers were then determined using the SAMS program. The result of this 
computation is shown in Figure 3-18 for the three MMDs and repair strategies. 
The number of modules replaced per visit can be observed to have a strong 
influence on the expected number of launches per year. By replacing more 
than the failed module, the expected number reduces substantially for condi- 
tional and perfect-failure prediction cases and reaches an apparent maximum 
effect at about 30 percent module replacement. These expected numbers 'krere 
supplied to the payload program cost program. 

5. PAYLOAD PROGRAM COST 

The LST costs were determined as described in Payload Program 
Cost Estimating. These were computed using the remote terminal for various 
MMDs, program durations, repair cost factors, trip charges, and repair 
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Figure 3-15. Modularized LST, Concept No. 
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Figure 3-17. LST System Reliability 

Based on Weibull Function 






strategies. These costs were based on a single satellite ou-orbit and are not 
applicable for a multi- satellite on-orbit system. 

Thi payload unit cost and total program cost are shown in Figure 
3-19 as related to MMD for the three tyn'^s of payloads (expendable, ground- 
refurbishable, and on-orbit maintainable). The unit cost is the ^ /load 
recurring cost, and the total program cost includes unit cost, RDTSjE, and 
operations costs. The unit cost increases as the MMD increases due to the 
increase in parts redundancy. The higher unit cost of an on-orbit maintainable 
payload over the expendable and ground- refurbished t\pes n ^ects the effect 
of modularity. The total program cost decreases as th*' irxreases for 

the expendable payloads but remains relatively constant for th / o^.-orbit 
maintainable payloads. The expendable program cost d^ops because of the 
reduction, mainly in the number of payload buys but alsc- ’ ibe expected 
number of launches The on-orbit maintainable program cost showed a lower, 
fairly constant total cost, because the number of oayload buys is the same 
over the range of MMD considered. The to al program cost of the ground- 
refurbishablc payload was between the on-orbit maintainable and expendable 
payloads. The total prograrti cost shows that in a short-duration program the 
number of payload buys is the primary cost driver. The 1. 5 ye«ir prof[iam 
duration basical* / equalizes the new' buys among the three types cf payloads 
and results in nearly equal total program cost lor the three types of payloads. 

In Figure 3-ZO, the total p" ")gram cost is shown s the program 
duration is varied. The on-orbit maintainable payload has a lower cost 
increase than the expendable payload The expendable payloads show a cost 
advantage for short-duration p^-ograms while the on-orbit maintainable pay- 
load shows lov. er costs as the program is extended. These cos.s aj..t,urned 
only one RDT&E e fort over the program duration whicn would indicate that 
the comparison is realistic only over that progran> life w'hjch does not requ’^e 
a major nev development effort. 

To examine the effect of repair cost on the total program cost, the 
on-orbit maintenance repair cost factor * the ground- refurbishment repair 
cost factor were varied about their nominal values of 0,r5 and 0. 39, 
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Program Duration, yr 


Figure 3-20. Effect of Program Duration on 
Total Program Cost for LST 





respectively. This result is shown in Figure 3-21 where the on-orbit main- 
tainable cost remains below the ground- refurbishable cost over the cost 
factor range and where both service concepts remained below the expendable 
payload. The difference in the total payload cost for the two service mode 
concepts is primarily due to the repair cost. The ground- refurbishment 
concept assumes that the complete payload will be refurbished > whereas the 
on-orbit maintainable concept assumes that refurbishment is only performed 
on the modules that are retrieved and returned. The other differences 
resulting from higher unit cost, higher expected number of launches, and 
lower launch- operation costs for on-orbit maintainable over ground- refur- 
bishment payloads are small in comparison to the difference in service cost. 

The trip charges were varied from dedicated launches to sharing 
the trip charges among five separate missions. The total program cost, as 
a function of trip charge, is shown in Figure 3-22 for the three types of pay- 
loads. It can be observed that this effect is small for a single satellite on- 
orbit. The cost slope is low and the cost ranking did not change. 

One aspect of on-orbit maintenance affecting a low-cost approach for 
long-duration missions is the repair strategy. The on-orbit strategy is a 
function of the number of modules to be replaced per visit and the failure 
prediction method. The effects of these two factors on the total program 
cost is shown in Figure 3-23. The cost reduces substantially if more than 
the failed module is replaced, up to an optimum at about 30 percent of all the 
space- replaceable modules in the payload. The conditional failure prediction 
is based on most probable failure times, and the perfect- failure prediction 
(PFP) is based on accurate failure prediction; i. e. , there is no time devia- 
tion about the failure time. To achieve PFP will require extensive instru- 
mentation, telemetry, and data analysis; however, with nominal module 
Instrumentation, one would expect that failed modules, penultimate failed 
modules, degrading modules, and modules with depleted consumables can be 
diagnosed accurately. Thus, the identification of modules to be replaced 
should be better than conditional and should approach PFP capability. The 
cost reduction is not significant enough to expend additional RDT&E funds 


87 



88 


r on 



Program Duration = 9 Yr. 
MMD = 1. 5 Yr. 

Nominal Repair Cost 


Total 

Program 

Cost, 

$M 



Figure 3-22. Effect of Trip Charge on 
Program Cost for LST 


89 



Total Program Cost, $M 


On-Orbit Maintauance (OM) 
Program Duration = 9 Yr. 

MMIi l.‘=> Vr. 



1 4 8 12 16 20 24 


Number of Modules Replaced per Visit 
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to achieve PFP beyond that for instrumentation required to identify module 
failure modes. 

From the cost analysis of the LST single payload on-orbit, the type 
of payload has been shown to be the most significant parameter influencing 
the cost. The program duration appears to determine the type of payload 
resulting in a low-cost approach. The repair cost factor and trip charge did 
not have significant impact on program cost. The proper repair strategy for 
on-orbit maintainable payloads appears to be to replace 30 percent of the 
modules per visit. 

C. SHUTTLE- LAUNCHED DEFENSE :>UPPORT PROGRAM DESIGN 
ANALYSIS 

The Defense Support Program (DSP) satellite was selected for 
analysis, because it represents an applications-type payload in a high-altitude 
orbit requiring a Tug. Also, design information and costs on this satellite 
were documented and complete enough to permit the analysis to be pursued. 

The current DSP is a spin-type payload, but it was modified in this 
study to a three- axis stabilized configuration. The payload configuration used 
in this study is not a recommended Shuttle- Launched DSP (SLDSP) design, but 
is a representative payload with adequate technical and cost data. The anal- 
ysis reported here used the technical data from Reference 3 to configure the 
SLDSP. This analysis differs from previous studies in that it was performed 
to evaluate the effect of payload parameters on total program cost and not 
to recommend a design or to produce a point design. Therefore, the payload 
modularity and reliabilities were varied over a wide range in this analysis. 
Moreover, the number of satellites in the system was limited to one, and 
the effect of a multi- satellite system was not investigated. 

1 . RELIABILITY MODEL 

The SLDSP reliability diagrams for the SYSOPT program were 
developed and the pertinent redundancy, failure rate, and weight information 
were compiled for the Shuttle- launched version of the DSP from available 
sources to minimize estimating. After the SLDSP was modeled, the 
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system was then reduced to a single- string configuration by removing the 
redundancies* 

The reliability block diagrams were dev'eloped from References 8 
and 9 and are shown in Figures 3-24 through 3-32 for the housekeeping 
portion only. Included with the reliability model are the failure rate, type of 
redundancy, and weight. The propulsion subsystem was changed to adapt it 
to the Shuttle. The attitude control subsystem was altered to a three-axis- 
stabilized type from a yaw- spin-type stabilization concept. In the areas 
where the level of reliability data needed was not provided in the referenced 
studies, previous contractor reliability analyses on the satellite were used. 
These include failure rates, duty cycles, internal redundancies, and modes 
of operation. 

The assumptions made in this task were as follows: 

a. The primary and backup units were identical. 

b. Expendables for one- year operation were used in the single- 
string configuration. The added expendables to the propulsion 
subsystems for three- month blocks were 7.25 kg (16 lb) 
expendables and 2.92 kg (6.4 lb) hardware. 

c. The units that were not made redundant were earth sensors 
(RADEC), adapters, inertial balancing mechanism, switches, 
and spaceframe. 

d. Components do not approach wearout within 10 years. 

e. Standby failure rates were 10 percent of active failure rates. 

f. Equivalent failure rates were estimated for boxes without 
failure data by estimating the reliability at ^5 months to com- 
pute the constant failure rate. 

The reliability data were inputted into the SYSOP T and the optimum 
redundancies based on weight were obtained for various payload MMDs. This 
characteristic is shown in Figure 3-33 starting from a single- string MMD of 
about 0. 5 years to a maximum MMD of about 4, 8 years. For this study, 
MMDs of 1, 2, and 4.5 years were selected for detailed analysis. 

T’ parts count for each unit modeled in the reliability diagram 
(except for the mission equipment) for SLDSPs with the three MMDs is listed 
in Table 3-11. This part count was then used for the conceptual design 
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Figure 3-24. SLDSP Structures and Propulsion Reliability Model 
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Figure 3-26. SL.DSP Communication Link 1 
Beliability Model 
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igur^ :>-28. SLDSP Communication Link 3 
Reliability Model 
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Figure 3-30. SLDSP Communication Data Transmission 
Reliability Model 
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SLDSP Attitude Control Reliability Model 







Mean Mission Duration, yr 
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Table 3-11. SLDSP Parts Quantity List 


No. 

RMHH 

Module 



tvr) 1 





Structure 

Structure 

None 

1 

1 



Propulsion 

Gas Generator Assy 

S 

H 

1 




Feed Assy 

s 

D 

1 

1 



Installation Hdwr 

s 

D 

1 

2 



Hi Level + Vernier Thrusters 

s 

1 

2 

2 



Low Level Thrusters 

S 

1 

1 

2 


Elec. Power 

Solar Array 

s 

1 

1 

1 

8 


Solar Array Drive Motor 

A 

1 

1 

2 

■■ 


Shunt Element Assy 

B(4) 

4 

4 

5 

HI 


Power Conditioning Unit 

S 

1 

1 

2 

mm 


Rec onditione r/ Batte ry 

B(2) 


2 

3 

D 

Elec. Distr* 

Elec. Integration Assy 

S 


1 

2 

19 


Auxiliary Integr. Assy 

s 

1 

1 

2 

14 


Platform Converter 

s 

1 


1 

IS 


Cabling 

A 

1 


1 

16 

Comm (Link 1) 

Hi Gain Antenna 

S 

1 


1 

17 


1 

Combiner 

S 

1 



18 


Convtr/Xmtr West 

S 


2 


19 


Convtr/Xmtr East 

s 


2 


20 


KGX 28 

s 


2 


21 

(Link 2) 

Hi Gain Antenna , 

s 

1 

1 


22 


Combine r 

s 

1 

1 


23 


Switch 

None 

1 

1 

1 

24 


Switch 

None 

1 

1 

1 

25 


Conv/ Xmtr/ DBA West 

s 

2 

2 

4 

26 


Conv/Xmtr/DBA East 

s 

2 

2 

4 

27 


KGX 28A 

1 

s 

2 

2 

4 

28 

1 

Digital Telem Unit 

s 

2 

2 1 

5 


NOTE: A = Active 

B = Binomial ( ) # Req'd 
N - Normal 
S = Standby 
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Table 3-11. SLDSP Parts Quantity List (Continued) 


No. 




■■1 


Module 


mi 

z 

KSl 

29 

Comm (Link 3) 

Omni Antenna 

A 


1 


30 


Diplexer 

A 


1 


31 


Hybrid 

A 




32 


Command Format 

S 




33 


Combiner 

A 

1 



34 


Switch 

None 

1 

1 

1 

35 


Down Convtr/ Uplink Portion 

S 

1 


4 

36 


Cmd Tone Generator 

S 

2 



37 


Ranging Filter Inhibit 

A 

1 

1 


38 


Conv h SC Cond Unit 

S 

2 

2 


39 

Data Link 
(Common) 

£HF It AQU Antenna 

A 

1 

1 

1 

40 


Dual Subdecoder 

s 

1 



41 


Dual Multiplier 

S 




42 


Monopulse Comparator 

A 




43 


Switch 

None 

1 

1 

1 

44 


Ant Structure Deploy 


1 

1 


45 

(Data %ntr) 

Diplexer 

A 

1 

2 


46 


Switch 

None 

1 

1 

1 

47 


Switch 

None 

1 

1 


48 


Power Supply/ TWT 

S 

1 

2 


49 


Hybrid 

A 

1 

1 


50 


Switch 

None 

1 

1 

1 

51 


Switch 

None 

1 

1 

1 

52 


X8-ADA-X4 Exciter (Link 1) 

S 




53 


X8-ADA-X4 Exciter (Link 2) 

S 




54 


Switch 

None 

1 

1 

1 

55 ' 


Link 1 Demodulator 

S 

2 



56 

(Cmd Xmtr 
kRecvr) 

Diplexer 

A 

1 



57 


Switch 

None 

1 


1 

58 


Avail Diode Amp/ Link 3 Exite r 

S 



4 

59 


Monopulse Combiner 

A 



3 

60 


Switch 

None 

1 

1 

1 

61 


Down Converter 

S 

2 

2 

4 
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Table 3-11. SLDSP Parts Quantity List (Continued) 


No. 


Module 

WalluivLiSBM 


KtUD 

lyWl 

i ' 

2 

maa 

62 

Attitude Cont 

Earth Sensor Assy 

B(3) 



IQH 

63 


Red. Equip Switch Assy 

s 




64 


Contr Elec Assy 

s 




65 


A C Converter 

s 




66 


Valve Driver Assy 

s 




67 


Rate Gyro Assy DC-. 0045 

s 

1 



68 


Sun Sensor Assy 

s 

1 

1 


71 


Gimbal Elec Assy 

s 

1 

2 

3 

72 


Single Axis Gimbal Drive 

A 

1 

1 

2 















analysis to examine module size and module simulation to compute the expected 
number of launches. 

2. CONCEPTUAL DESIGN 

The number of modules was varied from the eight space* replaceable 
modules in the reference SLDSP design reported in Reference 10. The vari- 
ations in this study are: 

a. Two and 13 space- replaceable module configurations 

b. Parts count as determined by SYSOPT optimum parts alloca- 
tion program 

The basic structural concept that was defined in Reference 10 was 
used for the 2- and 13-module configurations. The modules in each of the 
on-orbit maintainable configurations were volume checked to determine if 
they could accommodate the equipment necessary for each of the selected 
MMDs (1, 2, and 4.5 years). In addition to o orbit maintainable payload 
concepts, a brief examination was performed on the modifications that could 
be made to convert to a ground- refurbishable and an expendable payload 
version. 

a. Reference SLDSP 

Figure 3-34 shows the reference SLDSP (eight modules) reported in 

Reference 10 and included in this report for completeness. For this study, 

it was desired to determine if the equipment and components required to 

achieve MMDs of 1 , 2, and 4.5 years could be packaged in the reference 

concept. The parts listed in Table 3-11 were allocated to their proper space- 

replaceable modules, and the resulting module weights were determined. 

3 3 

Based on an average packing density of 320 kg/m (20 Ib/ft ), the required 
volume per module to contain the subsystems as described by the SYSOPT 
analysis for the MMDs of 1 , 2, and 4.5 years was determined. This required 
volume was then compared to the available volume in the reference design. 

The results of this comparison are shown in the center column of Table 3-12. 
From the table, it can be seen that the equipment can fit within the available 
0.38 m (13. 5 ft ) volume per module in all cases except for the Link 2/3 
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This figure intentionally omitted for 
security reasons. See Foreword. 


Figure 3-34. Space -Serviceable Spacecraft 
(Eight-Module Configuration) 
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Table 3-12. Required Volume Per Module 
For Subsystem Packaging 


ITEM 

MMD 

NUMBER OF MODULES 


\YT) 

2 

8 

13 



10“ 


in-2 3 
10 m 


tn-2 3 
10 m 


ACS Propulsion 

1.0 

1.4 

0.5 

1.4 

0.5 

0.9 

0.3 


2. 0 

1.4 

0.5 

1.4 

0.5 

0.9 

0.3 


4.5 

3.1 

1. 1 

3. 1 

1. 1 

1.7 

0.6 

Elect. Pwr/ 

1.0 

11.6 

4. 1 

11.6 

4. 1 

11.6 

4. 1 

Distribution 

2.0 

12.2 

4.3 

12.2 

4.3 

12.2 

4.3 

(No Solar Arrays) 

4.5 

23.8 

8.4 

23.8 

8.4 

23.8 

8.4 

C ommunication s 








Link 1 (1) 

1.0 

4. 0 

1.4 

4. 0 

1.4 

2.0 

0.7 


2.0 

4.0 

1.4 

4. 0 

1.4 

2.0 

0.7 


4.5 

7. 6 

2.7 

7.6 

2.7 

4.0 

1.4 

Link 2/^^^ 

1.0 

15.9 

5. 6 

15.9 

5 . 6 

15.9 

5.6 

Link 3 

2.0 

20.4 

7.2 

20.4 

7.2 

20.4 

7.2 


4.5 

46. 1 

16.3 

46. 1 

16.3 

46. 1 

16.3 

Data Link^^^ 

1.0 

10.5 

3. 

10.5 

3.7 

10.5 

3.7 


2. 0 

16.4 

5.8 

16.4 

5. 8 

16. 4 

5.8 


4.5 

28.0 

9.9 

28.0 

9.9 

28.0 

9.9 

ACS Elect. 

1.0 

9.6 

3.4 

9.6 

3.4 

4.8 

1.7 


2.0 

13.6 

4. 8 

13.6 

4.8 

6.8 

2.4 


4. 5 

26. 0 

9.2 

26. 0 

9.2 

13.0 

4.6 

Sensor Elect* 

1.0 

54.0 

19. 0 

54. 0 

19. 0 

54.0 

19.0 

ronics (4) 

2.0 

73.6 

26.0 

73.6 

26.0 

73.6 

26.0 


4.5 

120. 1 

42.6 

120. 1 

42. 6 

120. 1 

42. 6 

Available (5) 

V olume / Module 


566.0 

200. 0 

38.0 

13.5 

28.0 

10. 0 


NOTES; 

(1) Link 1 volumes have been added to the payload volumes for total \SRU 12) 
required volume. 

(2) Link 2 and Link 3 are in the same module. 

(3) Data link equipment is on the back of the antenna. Module volume 
constraints do not apply. 

(4) Optics weight is not included in modules. 

(5) Available volumes based on a 4.4m (14.5 ft) dia x 0.76m (30 in) deep 
baseline spacecraft. 


page blank. 
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communications module in the 4.5-year MMD case and the sensor electronics 

in nearly all cases. By increasing the packing density of the sensor electronics 

3 3 3 3 

to 641 kg/m (40 Ib/ft ) from the previously assumed 320 kg/m (20 Ib/ft ), 

the electronics can be packaged in the sensor module in the 1- and 2-year 

MMD configuration. Likewise, the Link 2/3 equipment for the 4.5-year MMD 

3 3 

can also be packaged by increasing its packing density to 641 kg/m (40 Ib/ft ) 
from 320 kg/m^ (20 Ib/ft^). The 641 kg/m^ (40 Ib/ft^) packing density is 
considered to be a maximum and is based on densities achieved with a man- 
euvering reentry vehicle. The impact on the design, if this higher density 
were to be used, would be to reduce accessibility for installation, checkout, 

and repair of equipment and possibly increase equipment heating problems. 

3 3 

However, even with the 641 kg/m (40 Ib/ft ) packing density, the 

sensor electronics required for the 4. 5- year MMD exceed the available 

packing volume. There are several design solutions for this problem. One 

is to lengthen the spacecraft from 0.76 m (30 in. ) to 2.4 m (95 in. ) in order 

3 3 

to increase the available volume per module to 1. 21 m (42. 6 ft ). This 

would allow packing of the sensor electronics in a single module at a packing 

3 3 

density of 320 kg/m (20 Ib/ft ). Lengthening the spacecraft only 1.2 m (47 

3 3 

in. ) would allow packaging at a density of 641 kg/m (40 Ib/ft ). Another 
solution is to divide the Link 2/3 and the sensor electronics into two modules 
each. This concept would have to be studied to determine the impact on the 
data bus design and the module/ spacecraft electronics interface. 

b. Maximum- Module SLDSP 

The subsystems of the reference SLDSP were studied to determine 
the maximum number of modules into which they could be divided. With the 
aid of various technical specialists, the subsystems were divided into 13 
modules and arranged as shown in Figure 3-35. 

It should be noted that there are spaces for 16 modules, beginning 
with No. 1 in the l:00-o*clock position and proceeding clockwise to No. 16. 
Spaces 1, 2, and 15 are left empty to provide a clear view for the second- 
surface mirror radiator on the sensor (module No. 16). Spaces No. 1 and 15, 
however, contain second- surface mirrors to provide a cold viewing surface for 
the radiator. 


no 



This figure intentionally cn for 

security reasons. See Foreword. 


Figure 3-35. SLDSP Spacecraft (13-Module Configuration) 
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Modules 3, 5, 11, and 13 contain the attitude control pr^oulsi^n. 

The propulsion subsystem was divided into four self-contained m ’les in 
order to gain a longer control moment arm about the roll ajcis. ' \ey were 
placed in slots 3, 5, 11, and 13 rather than the 45-deg slot posit on a 2, 6, 

10, and 14 in order to avo’d interference with the second- surface mirrors of 
the sensor aud also to allow for placement of the cr^ ^‘-•link antenna in slot 
No. 6. 

Module No. 4 cor ins a completely redundam Link 1 data trans- 
mission system including a replaceable antenna. The Link 1 system is com- 
pletely redundant, rather than partially redundant, to avoid a large impact 
and ma] jr redesign on the data bus and also to avoid a multi-pin connection 
a the module /spacecraft interface. 

Module No. 6 contains the cross-link communications system. To 
reviuce power losses and to eliminate waveguide interfaces, the electronics 
were placed on the back of the antenna. This system could not be split-up 
into more than one module due to the large power losses which would be 
incurred with long lengths of waveguide. 

Modules No. 7 and 10 conta^'u completely redundant attitude control 
electronics and sensors. The RADEC systems were split between modules 
No. 8 and 9 because their functions are distinct and somewhat different. 

Module No. 12 contains the Link 2 and 3 communications system. 
This system could not be split into more than one module because of the 
impact on the design of the data bus. Also, the basic single- pin module/ 
spacecraft interface described in Reference 10 would have to be increased 
to a multi-pin connector should the Link 2/3 system require . plitting. 

The electrical power system, consisting of a single array and 
batteries, was left in one module. Attempts to split the array into two 
resulted in mutual array shadowing and interference with the line of sight for 
the radiators. 

Module No. 16 contains the sensor, the second Link 1 system, and 
the Data Processing Electronics System. It is uncharged from that described 
in Reference 10. 
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Table 3-11 lists the parts count provided by SYSOPT. The Link 1 

systems are located in modules 4 and 16 and were designed to be completely 

redundant systems; i.e. , the system in module 4 is to be identical to that in 

module 16. However, the equipment list was changed to show a single antenna 

and son.e electronics in module 16 and the remainder of the Link 1 electronics 

in module 4, The impact of this equipment split on the design is not known. 

It is quite possible that it would require multi-pin connectors at the module/ 

spacecraft interface, and perhaps require that the data bus be redesigned. 

The equipment required for achieving MMDs of 1, 2, and 4.5 years 

was checked to determine if it could be packaged within the module as shown 

in Table 3-12. As with the 8- module configuration, problems arose with the 

13- module configuration. In this case, the spacecraft would have to be 

lengthened to 3.25 m (128 in. ) to accommodate the sensor electronics in a 

3 3 

single space- replaceable module package at 320 kg/m (20 Ib/ft ) or length- 

3 3 

ened to 1.62 m (64 in. ) to package it at 641 kg/m (40 Ib/ft ). The design 
possibilities for this problem would be the same as those suggested for the 
eight-module configuration. 

c. Minimum- Module SLDSP 

Figure 3-36 is an outboard profile of a SLDSP spacecraft configured 
with two modules. Although the shape of the 2-module payload is somewhat 
different than that of the 8- and 13-module versions, the baseplate concept 
and the index/translation motion for removal /replacement of the module is 
retaL^ed. The configuration was developed to determine the distribution of 
equipment for each module for use in the reliability model. There are no 
problems involved with packaging the equipment required for MMDs of 1, 2, 
and 4.5 years into this spacecraft as shown in Table 3- 12. 

d. Ground- Refurbishable and Expendable SLDSPs 

A ground- refurbishable version of the DSP, based on the concept 
developed for the on-orbit maintainable SLDSP, would be identical to the 
version shown in Figure 3-34 except that the equipment required for on-orbit 
servicing would be removed. This would include the baseplates, tracks, and 




preceding 


This figure intentionally omitted for 
security reasons* See Foreword. 


Figure 3 - 36 . SLDSP Spacecraft Two-Module Configuration 
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perhaps ^he data bus. The baseplates would be replaced with the necessary 
bracketry for eq;’ipment mounting tied directly to the semi-monocoque 
structure. Also» the replaceable drives would be replaced with conventional 
shaft connections. 

The redundancy requirements to achieve MMDs of 1. 2 , and 4.5 
years would not result in the same peckaging problems as for the space* 
serviceable ve*“sions, because the envelope constraints of the individual 
module no longer apply since the modules are no longer removable. 
equipment may be mounted on the inside of the main structural ring to 
increase the envelope available for equipment packaging. 

The expendable SLDSP is identical to the ground* re furbishable 
SLDSP except that, in addition to the removal of the servicing equipment, the 
docking cone is also removed. Here again, an increase in usable volume for 
the equipment packaging is available on the inside of the main structural ring. 

Due to brevity of the study, the ground* refurbishable and expendable 
versions of the SLDSP were assumed to be simplified versions of the on-orbit 
maintainable version for comparative purposes. It should be noted, however, 
that if either concept proves attractive, specific configurations should be 
developed which would be optimized for either the ground* refurbishable or 
expendable SLDSP payload rather than using configurations based on an on- 
orbit maintainable SLDSP. 

3. MASS PROPERTIES 

The reference SLDSP weight estimate was developed from the 
Spacecraft Synthesis Program (SSPRO) using the mission equipment defined 
in Reference 10. The SLDSP reference weight is for an expendable payload 
that is three-axis stabilized with a one* year MMD. The current expendable 
satellite is a yaw- spin configuration. The major differences between the 
current and the reference configuration are the changes to the mission equip- 
ment, stabilization concept, and structural design to use the full 4. 4-m (14. 5-ft) 
diameter, and the elimination of the movable ballast. 

With these modifications to the configuration for on-orbit servicing, 
the reference weight was determined using the SSPRO. A printout of one 
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SLDSP case is duplicated in Table 3-13 which includes the weight estim. tes 
for the reference weight and three Shuttle payload typeb. It should be ’•e* og- 
nized that for the case examined in Table 3-13, the reference payload weif’ c 
is for a one-year MMO and the three Shuttle payloads are for two-year MMOs. 

To account for the MMD effect on weight, the parts count determined 
by the SYSOPT program was used. The resulting weight relationship is 
provided in Figure 3-37 for the subsystems including the mission equipment. 
The influence of modularity was determined from several payload modularity 
studies. These data were shown in Figure 2-4. With the MMD and modularity 
relationships, the SSPRO computed the weights as MMD was varied from 1 to 
4.5 years and nr.odularity was varied from 2 to 13 space- replaceable modules. 

4. EXPECTED NUMBER OF LAUNCHES 

The expected number of launches for the SLDSP was determined 
from the SAMS program for configurations with 2, 8, and 13 modules and 
MMDs of 1, 2, and 4. 5 years. The Weibull functions for each of these 
modules were computed from the reliability model. These functions are 
listed in Table 3-14 with an estimate of the predicted MMD. These were inputted 
into the SAMS to compute the expected number of launches for the three types of 
replacement strategy (random, conditional, and perfect failure prediction) 
which were considered in evaluating the method of selecting the modules to 
be replaced beyond the failed module. The expected numbers that are shown 
in Figures 3-38, 3-39, and 3-40 are applicable to on-orbit servicing of space- 
replaceable modules. The non- replaceable module consists of the spaceframe, 
cables, and sensor optics, and any failures in these areas will require ground 
refurbishment. The expected number of launches per year for the non- 
replaceable items is 0.014 for all of the on-orbit maintainable configurations. 

5. COST ANALYSIS 

The unit cost of the SLDSP was computed for expendable, ground- 
reiurbishable, and on-orbit maintainable payloads with MMDs of 1 , 2, and 
4. 5 years. These costs are shown in Figure 3-41. Also shown in the figure 
is the total program cost of a one-SLDSP on-orbit system for a 10- year 
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Table 3-13. SSPRO Weight Prediction for the SLDSP Payload (Continued) 
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ure 3-37. SLDSP Weight Factor 


Table 3-14. Weibull Functions for SLDSP Modules 
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Figure 3-38. Expected Launch Ra^e for a Two- Module SLDSP 
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Launch Rate per Year 



Number of Modules Replaced per Visit 
Figure 3-39, Expected Launch Rate for an Eight-Module SLDSP 
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Figure 3-41. Effect of Mean Mission Duration on SLDSP Unit 
and Program Cost 
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program duration. The total program cost includes payload unit, operations, 
and RDT&E cost. The on-orbit maintainable and ground- refurbishment pay- 
loads appear to reach a minimum program cost, but the total program cost 
of the expendable payload continues to decrease as is increased. At a 

4.5-year MMD, the ground- refurbish?tble and on-orbit maintainable payloads 
are not expected to require refurbishment because the spare payloads will 
service the expected failures. It is not economical to design payloads with 
MMDs beyond what can be effectively used during the program duration un- 
less high reliability is desired. The optimum MMD for on-orbit servicing 
of a one- satellite system appears to occur at about two years and it should be 
more economical than a 4. 5-year expendable payload. Sortie payload is not 
included in this comparison because the mission operates at high altitude. 

The repair strategy for the configurations with the 2, 8, and 13 
modules was performed by varying the numoer of modules replaced per visit. 
The results of this tradeoff are shown in Figures 3-42 and 3-43 which reflect 
the performance limits of the Tug. For the 8- and 13-module designs the 
4- and 6-module replacements, respectively, exceed the Tug service- sharing 
capability. The Tug is performing dedicated service missions when more 
than four and six modules per pay load are replaced. The minimum cost 
however, is reached prior to exceeding the Tug perform.ance capability. The 
optimum appears to be replacement of about 3 and 4 modules for the 8- and 
13-module configurations. This amounts to about 30 percent of the total 
number of space- replaceable modules that should be replaced per visit. 

The cost effect of the number of modules in a payload on total 
program cost is shown in Figure 3-44 for designs with MMDs of 1 , 2, and 
4.5 years, Both the 8- and 13-module configurations reflect the 30-percent 
replacement concept; however, the 2-module configuration cannot show this 
effect because any servicing will replace 50 percent or 100 percent of the 
modules. The 4. 5-year MMD design does not show this pattern for a two- 
module configuration since there is no maintenance performed on the replaced 
modules. This tradeoff indicates that the number of modules in the payload 
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Total Program Coat, $M 




should be enough to effectively utilise the 30-percent optimum replacement 
for a one- satellite system. Operational satellites which generally have 
several satellites in the system may exhibit a different optimum replacement 
percentage. The multi^payload case should be investigated in any follow-on 
study. 
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4. COMMON HARDWARE 


A. INTRODUCTION 

The results of two studies are presented which indicate the potential 
savings in costs that may result from the utilization of common attitude con* 
trol subsystem hardware and of standardized solar cell modules. Common* 
ality of spacecraft hardware should, of course, be a very powerful means of 
reducing payload costs. Also, for the concept of on*orbit service and repair 
of spacecraft subsystems by the Orbiter or Tug to be feasible, it is necessary 
to have equipment in the form of easily replaceable modules, and it is essential 
to standardize these modules to the greatest extent possible for refurbish* 
ment. 

In order for a single attitude control design to be suitable for a 
group of vehicles having different values for the design parameters which 
determine stabilization requirements, a common specification bounding the 
requirements must be met by the subsystem. That is, it must satisfy the 
mission requiring the greatest accuracy, the one with the longest design life, 
the one with the heaviest vehicle, etc. This implies that for some, if not all, 
of the missions, the equipment is overdesigned and, therefore, is probably 
larger and heavier than sabsystems would be if they were custom designed 
for each particular application. However, overdesign can be viewed as 
performance margin and, as will be discussed presently, may prove to be 
advantageous if held within reasonable bounds. Furthermore, in view of 
the Shuttle's capability for placing very heavy payloads into orbit, the impor* 
tance of small size and weight can be de*emphasized. 

At every step, from the original conceptual design to the end of the 
operational phase, commonality of subsystem hardware can provide large 
cost savings on a space program involving a number of different missions 
(Table 4-1). 
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Table 4-1. Cost Savings from Common Hardware 


ACTIVITY 

REASONS FOR LOWER COST 

Preliminary System Studies 

Fewer studies 

Preliminary Development 

Fewer development areas 

Preliminary and Final Design 

Fewer designs 

Drawings 

Fewer drawings 

Tooling 

Common tooling 

Fabrication 

Lower unit costs due to large 
quantities of same parts 

Acceptance Test 

Common test specs, test procedures, 
and test equipment. Simplified 
training of test personnel 

Final Development 

Fewer designs to debug 

Installation 

Common fixtures. Simplified train- 
ing of installation personnel 

Pre-flight Checkout 

See Acceptance test, above 

Maintenance and Repair 

Common tools, instructions, pro- 
cedures and spare parts. Simpli- 
fied training of maintenance and 
repair personnel 
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The performance margin provided by designing the equipment to 
the ’’worst-case” specification* covering a group of space vehicles with 
varying requirements, can be a valuable feature* For example* assume 
that on a group of 12 different vehicles* 3 require a pointing accuracy of 
0. 002 radians while 9 others need only 0. 01 radians. The attitude con- 
trol subsystem woul i then have to be designed around the 0. 002 -radian 
requirement* which is five times as accurate as it needs to be for three 
quarters of the flights. However* on these nine missions* there is a five- 
to-one performance margin which means that the equipment accuracy could 
deteriorate in service by a factor of five and still meet specified pointing 
requirements. This should significantly improve the reliability and life of 
the subsystem. 

Another possibility for exploiting performance margin is to have 
two classes of test specifications for the same equipment; one giving require- 
ments for high-accuracy missions and another for the less-accurate missions. 
On the latter equipment* the performance margin could significantly reduce 
test costs. Subsystems presently in production appear to be designed with 
little performance margin* which is probably due to the current emphasis on 
small size and weight. Unless they are ’’tuned up” with each assembly at 
peak performance* they are likely to fail certain tests. As a result, months 
may be wasted nursing such equipment through test since many adjustments* 
replacements* and reruns must be made. In addition, much time and effort 
may often be devoted to negotiating waivers with the procuring agency. 

The use of two sets of specifications must be traded off against 
other considerations* such as the necessity for having two types of spare 
subsystems as an example. Also* caution is advisable when equipment 
shows errors during test which are significantly larger than those permitted 
by the high- accuracy specifications. This may indicate a malfunction which 
will seriously jeopardize the reliability on the moderate-accuracy 
applications. 
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Commonality results in larger quantities of each item and should 
also increase reliability, since larger production runs usually produce more 
reliable equipment. Most of the ‘'bugs" are disclosed on early lots, and 
appropriate action has already been taken to remove them before the majority 
of the units are manufactured. Many of these problems are not design defi- 
ciencies but are in the area of quality control. As the program proceeds, 
modified manufacturing or assembly operations and additional inspection 
procedures can be initiated to prevent recurrence of these problems. 

It appears that the policy of common hardware should be adopted 
to the greatest possible extent on payload subsystems. This approach should 
result in very significant cost savings in engineering, manufacturing, test, 
maintenance, and repair and should provide hardware having improved 
reliability. 

B. ATTITUDE CONTROL HARDWARE 

The spacecraft stabilization requirements for 53 different payloads 
were determined from the 1971 and 1972 Shuttle Payload Data Books (Ref. 

11 and 12). A total of 177 flights is planned for these payloads, some involv- 
ing as many as 12 flights. 

The 53 payloads were arranged in 14 groups in which the mission 
stabilization requirements and sp.'tcecraft configuration appear sufficiently 
similar to permit common attitude control subsystems to be employed 
without considering design life. It was assumed in this study that mean 
mission duration times for on-orbit or retrieval servicing intervals can be 
achieved by redundancy of the same stabilization assemblies. 

Since all Sortie missions covered in the 1972 NASA Payload Data 
Book are stated to require no stabilization subsystem (because attitude 
control will be provided by the Orbiter), the question of stabilization hard- 
ware commonality on that type of mission was not addressed. 
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1 . 


ANALYSIS 


The 53 payloads considered in this study were taken from the NASA 
and Civil Payload Data Summary. This summary lists 68 missions from the 
1972 NASA Payload Data Book and 9 from the 1971 Data Book. A total of 
24 payloads was eliminated from the study, since they involved revisits and 
Sortie missions in which attitude control is supplied by the Orbiter or 
special payloads, such as large space stations and planet rovers, which are 
not compatible with the common hardware concept. The information given 
in the Payload Data Books was incomplete for many of the payloads. In 
areas where data was lacking, estinnates were developed based on mission 
descriptions. 

Initially, the payloads were tabulated in three-axis and spinning 
groups. These were in the order of payload number and included param- 
eters affecting stabilization requirements such as pointing and attitude 
determination accuracies, reference orientation, altitude, payload weight, 
life, maintenance policy (expendable, on-orbit, or ground- refurbishable), 
and Shuttle visit intervals. In addition, the types of attitude control assem- 
blies specified in the Payload Data Book were listed. 

The kinds of stabilization sensors and actuators to be employed 
depend upon both the vehicle configuration and the type of mission. Possible 
vehicle types and missions were envisioned as follows: 

Vehicle Configuration 

Type 1: Three -Axis Pneumatic Control 

Type 2: Yaw Spin (vehicle angular momentum cancelled by 

counter-rotating wheel) 

Type 3; Three -Axis Momentum Control (control moment 
gyro or reaction wheel) 

Type 4: Pure Spin 

Type 5: Dual Spin 
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Missions 


Class I: Earth Orbit, Earth Pointing 

Class II: Stellar /Sun Orientation, Non-Earth Pointing, 

Heliocentric, Planet Flyby 

Class III: Planet Orbit 

The vehicle types can be considered to fall into two major classifi- 
cations: those having angular momentum and those with zero angular momen- 
tun (see Figure 4-1). A review of the payloads covered by the study showed 
that Class I, II, and III missions we^e called for in Type 1, 3, and 4 vehicles* 
No missions involved Type 2, and all those under Type 5 were Class I. 

The first grouping of payloads for determining common hardware 
potential was based on the premise that for a given vehicle configuration and 
mission class, the attitude sensor characteristics are largely determined by 
pointing accuracy, and the actuator (**muscle’*) requirements are dictated by 
pointing accuracy and vehicle weight. Therefore, all missions for each 
combination of vehicle configuration and mission class were arranged in order 
of decreasing pointing accuracy. Where accuracies were the same, the 
payloads were tabulated in order of increasing vehicle weight. A typical 
listing of this kind is shown in Table 4-2, which covers Type 3 vehicles (three- 
axis momentum control) and Class I missions (earth orbit, eanh pointing). 

The horizontal lines show how the subsystems fall into four groups: (1) high 
accuracy, (2) medium accuracy /light weight, (3) medium accuracy /heavy 
weight, and (4) low accuracy. Furthermore, there could be considerable 
commonality of actuators and sensors. One actuator design would probably 
be required for the 136-kilogram (300-pound), lightweight vehicles, but, 
conceivably, a single additional design could handle all other vehicles, which 
range in weight from 454 to 1, 361 kilograms (1, 000 to 3, 000 pounds). Com- 
mon sensors could probably be used on both lightweight and heavyweight, 
moderate-accuracy systems. 


Angular momentum as used in this study does not refer to inertial angular 
momentum but is measured relative to a reference coordinate frame; 
e. g. , a local vertical orbit plane reference frame. 


136 




c • 


137 


Figure 4-1. Classification of Attitude Control Subsystems 













Table 4-Z. Type 3 Vehicles, O.ass I Missions 
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Abbreviations: NG - Not Given R - Retrieve and Refurbish 

O - On-Orbit Repair SYN - Synchronous Orbit 34,800 kilometer (19, 323 


























































It appears desirable that certain other payloads having similar 
attitude control requirements should employ different configurations of 
stabilization hardware: 

a. The mission might specify use of a slightly modified version 
of an existing spacecraft, such as Mariner, Pioneer, or 
Tiros. This would avoid the cost and risk involved with 

a completely new vehicle design. 

b. A spinning payload might be needed for certain sensors used 
on the mission. 

c. Large vehicles requiring frequent repointing should probably 
employ control moment gyros. 

d. Certain types of missions may require some sort of momentum 
control in order to conserve propellant. 

With these constraints in mind, the initial groups of the types shown 
in Table 4-2 were reduced in number by combining payloads that had similar 
attitude control requirements but with different stabilization hardware con- 
figurations specified in the Payload Data Books. This resulted in a total of 
14 groups. Because of the unique requirements of certain missions, six of 
the groups consisted of only one or two payloads. The remainder of the 
groups had 3 to 13 missions. There was a total of 53 different payloads 
involving 177 flights. (See Tables 4-3 through 4-16. ) 

In the Payload Data Books, five of the satellites are specified to 
be the dual spin type. These are payloads NE2-41, NC2-49, NCN-7, 

NCN-8, andNCN-9. Since stabilization sensors and actuators are mounted 
on the non- spinning portion of the spacecraft, as on three -axis subsystems, 
it appeared that further hardware conamonality could be achieved by changing 
the dual-spin types to the three-axis momentum bias configuration. Sensor 
and actuator requirements were similar to those on a group of three-axis 
subsystems employing the momentum bias technique, and the five dual 
spinners were shifted to that type of attitude control. 

As mentioned above, six of the groups contain only one or two pay- 
loads, due to unique requirements. The payloads involved are as follows: 
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ATTITUDE CONTROL TYPE: 3-Axis 

SENSORS: Rate Integrating Gyros, Sun Sensor, Star 

Sensor, Vidicon 
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ATTITUDE CONTROL TYPE; 3- Axis 

SENSORS: Rate Integrating Gyros, Sun Sensor, Star Senior 
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Table 4-6. Group 4 
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ATTITUDE CONTROL TYPE: 3-Axl* 

SENSORS: Special Two-Degree>of*Freedom Gyroa. Earth Senior, 

Sun Senior, Star Senior, Teleicope 

ACTUATORS: Reaction Wheeli, Man Expuliion 
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Table 4-8* Group 6 
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SENSORS; Earth Sensori 
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Table 4'10* Group 8 
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ATTITUDE CONTROL TYPE: 3-Axis 

SENSORS: Rate Integrating G/ros, Sun Sensors, Star Sensors, Mission 

Equipme nt 

ACTUATORS: Control Moment Gyros, Mass Expulsion 

ACCURACY (MRAD): 0.0052 - 0.297 PAYLOAD WT. (KG); 7, 158 - 14,643 
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Table 4-14* Group 12 
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ATTITUDE CONTROL TYPE; Pure Spin 
SENSORS; Sun Sensor, Star Sensor 

ACTUATORS; Single Reaction Wheel, Mass Expulsion 
ACCURACY (MRAD): 17,5 PAYLOAD WT. (KG): 290 
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Table 4-16. Group 14 
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a. Explorer (NA2-1, NA2-2) - No other mission requires this 
combination of high pointing accuracy ^ milliradians) 
and light vehicle weight (169 kg). 

b. Radio Astronomy Observatory (NA2-11) - This a spinning 
vehicle that stabilizes a circular antenna (10 kilometers in 
diameter) as well as four small outer satellites attached to 
the antenna. A special actuator design is expected to be 
required, since unusual dynamic problems appear likely. 

c. Explorer (NP2-15) - This is a special spinning vehicle 
employing a single reaction wheel for varying the spin speed. 

d. Gravity and Relativity (NP2-16, NP2-17) - These are 

relativity theory experiments that require very special gyro- 
scopes with drift uncertainties of 7. 69 X 10 * radians '«?ec 

(0. 0005 arc seconds per year), which is far beyom' the state 
of the art. 

e. Encke Rendezvous (NU2-36) - This comet randezvous missi-m 
requires a special vidicon sensor to achieve .he specified 
pointing accuracy of 0.29 milliradians (1 arc minute). 

f. Bio-Research Module (NB2-55) - The low accuracy ^^inting 
requirement (87. 3 milliradians) can probably be achieved 
without the use of gyros or other momentum devices employed 
on all other three-axis vehicles. 

Gravity gradient stabilization was specified in the Payload Data Book 
for Geopause (NE2-45) which requires a pointing accuracy of 52 milliradians 
(3 degrees). However, an attitude determination accuracy of 0. 15 milliradians 
(30 arc seconds) is also specified, which will necessitate a star sensor. By 
changing from gravity-gradient to momentum bias stabilization, it was possi- 
ble to group this paylcad with others of similar size which also have star 
sensors of the same order of accuracy. 

Because magnetic torquing is feasible only over a limited range of 
altitudes, it has not been specified on any of the subsystems, since it would 
increase the number of groups, and this would be undesirable from the 
commonality standpoint. 


154 



2 . 


RESULTS 


Tables 4-3 through 4-16 divide the 53 payloads covered by this study 
into 14 groups. On the basis of the inforrration contained in the 19*71 and 
1972 Payload Data Books, it appears that aJi of the missions tabulated .n a 
given group could be handled by a common atdtude control subsystem. 

Each table lists the system requirements and the types of sensors and 
actuators proposed for the common stabilization system. It will be noted 
that the ranges of accuracies and vehicle weights on each chart are restricted, 
so that the same sensor and actuator can be employed for all missions in the 
group. 

On some charts, the range of mean mission durations is rather l^rge, 
particularly on distant p?anet flybys which, of course, are expendable and 
cannot be serviced at regular inter^’^als. In order to achieve the desired 
life and reliability on extended missions, it will be necessary to employ 
redundant, dormant assemblies. However, it should be noted that this does 
not affect commonality of hardware, since identical assemblies can be involved. 

The redundancy required for meeting expected life or mean mission 
duration specifications could be based upon the design life of current hard- 
ware. However, the extent to which redundancy must be employed for 
enhanced reliability is beyond the scope of this study. It involves factors 
for which information is not available, such as the ▼•equired reliability for 
the entire spacecraft and the extent to which the failure rates of other sub- 
systems contribute to the overall reliability. Therefore, the number cf 
redundant assemblies needed has not been specified at this time. 

In the case of the Large Solar Observatory (NA2-7), which weighs 
14,643 kilograms (32,282 pounds), redundant control moment g, ros of the 
type used on lighter vehicles in the group will be required in order to meet 
torquing requirements. 

A complet 3 attitude control subsystem involves a number of dif- 
ferent assemblies: attitude sensors, sensor electronics, actuators, actuator 
electronics, interface electronics between the sensors anu actuators. 
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and a computer for such functions as control law implementation, sequencing 
discretes, and failure detection analysis. For the concept of on-orbit 
servicing, subsystems will presumably be modularized. These modules 
must be accessible to the Orbiter or Tug for on-orbit checkout, replenish- 
ment of consumables, and for removal and replacement. 

Since different functional considerations determine the location of 
sensor and actuator assemblies, it seems logical to assume that they will be 
in separate modules. Also, it appears desirable to include the associated 
electronics in each module. Different groups of missions will require dif- 
ferent combinations of sensor and actuator modules. Therefore, for module 
commonality, the interface electronics should be in a sepwirate module* 

Off-the-shelf hardware could probably satisfy the requirements for 
most of the groups of common attitude control s .bsystems shown in Tables 
4-3 through 4-16 Specific hardware has been identified in Table 4-17 for 
each of the 14 groups, where currently available sensor and actuator assemblies 
appear capable of meeting the performance requirements. This has been 
done to show the feasibility of employing one common assembly for handling 
the range of j>erformance covered by all of the missions in each group. 

Actually, hese particular pieces of hardware would probably not be employed. 
The missions involved are scheduled far into the future, and miproved, 
more reliable equipment will undoubtedly be available by that time. Also, 
the concept of replaceable modules will almost certainly result in extensive 
design changes current hardware. Table 4-18 summarizes the common 
hardware assemblies required for the 14 groups. 

C. SOLAR ARRAY 

Interest in reducing the cost of solar cell power systems in recent 
years has given rise to the concept of solar array standardization as a 
potential cost savings technique. It is reasonable to think that the present 
arrays which are custom designed specifically ^r each mission are more 
costly than a solar array - gn which has been standardized. An uncertainty 
which clouds the feasibility of standardization, however, is the possibility 
of increased array weight and array area which might ultimate ,y result in 
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Table 4- 17. Applicable Current Hardware 


GROUP 

NO. 

ASSEMBLY 

MANU- 

FACTURER 

MODEL 

REMARKS 

1 

Rate-Integ. Gyros 

Lockheed 

ARA 



Sun Sensor 

ADC OLE 

1401 



Star Sensor 

TRW 

Pioneer F/G 



Vidicon 
Jet Thrusters 

Lockheed 

Agena 

Special Design 

2 

Rate-Integ. Gyros 

Loc kheed 

ARA 



Sun Sensor 

ADCOLE 

1401 



Star Sensor 

TRW 

Pioneer F/G 



Planet Sensor 
Jet Thrusters 

Lockheed 

Agena 

Data Unavailable 

3 

Rate«Integ. Gyros 

Lockheed 

ARA 



Sun Sensor 

ADCOLE 

1401 



Star Sensor 

TRW 

Pioneer F/G 



Jet Thrusters 

Lockheed 

Agena 


4 

Earth Sensor 

Barnes 

13-181X 



Sun Sensor 

ADCOLE 

1401 



Jet Thrusters 

Lockheed 

Agena 


5 

2-Deg-f ree-Gyro 



Special 7.69 X 
10” mrad/sec 

! 

Earth Sensor 

TRW 

AOGO 



Star Sensor 

ITT 

OAO 

Telescope sensor 




Bo re sighted 

for fine pointing 


Sun Sensor 
(3) Reaction 

Bendix 

1818823 



Wheels 

Sperry 

45Q RWA 



Jet Thrusters 

Lockheed 

Agena 


6 

Earth Sensor 

TRW 

AOGO 



Sun Sensor 

ADCOLE 

1401 



Star Sensor 

ITT 

OAO 





Bo re sighted 



IvjLomenturn Wheel 

Sperry 

45Q RWA 



Jet Thrusters 

Lockheed 

Agena 
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Table 4-17. Applicable Current Hardware (Continued) 


GROUP 

NO. 

ASSEMBLY 

MANU- 

FACTURER 

MODEL 

REMARKS 

7 

Earth Sensor 
Sun Sensor 
Momentum Wheel 
Jet Thrusters 

TRW 

ADCOLE 

Bendix 

Lockheed 

AOGO 

1401 

1880272 

Agena 


8 

Earth Sensor 
Sun Sensor 
Momentum Wheel 
Jet Thrusters 

TRW 

ADCOLE 

Sperry 

Lockheed 

AOGO 

1401 

45Q RWA 
Agena 


9 

Rate-Integ. Gyros 
Sun Sensor 
Star Sensor 

CMG's 

Jet Thrusters 

Lockheed 

Bendix 

ITT 

Bendix 
Loc kheed 

ARA 

1818823 

AOA 

Bo resighted 
HEAO 
Agena 

Telescope sensoi 
fine pointing 

10 

Sun Sensor 
Star Sensor 

Jet Thrusters 

ADCOLE 

ITT 

Lockheed 

1301 

OAO 

Bo re sighted 
Agena 


11 

Sun Sensor 
Star Sensor 
Jet Thrusters 

■ - ■ - I 

ADCOLE 

TRW 

Lockheed 

1301 

Pioneer F/G 
Agena 1 


12 

Sun Sensor 
Star Sensor 
Jet Thruster 

ADCOLE 

TRW 

Lockheed 

1301 1 

Pioneer F/G 
Agena 

Dynamic Proul. 
expected that ma^ 
require special 
actuator design 

13 

Sun Sensor 
Star Sensor 
(1) Reaction 
Wheel 

Jet Thrusters 

ADCOLE 

TRW 

Bendix 

Lockheed 

1301 

Pionee r F/G 

1880272 

Agena 

On spin axis 
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Table 4- 17. Applicable Current Hardware (Continued) 


1 GROUP 
NO. 

ASSEMBLY 

MANU- 

FACTURER 

MODEL 

REMARKS 

14 

Sun Sensor 

ADCOLE 

1301 



Star Sensor 

TRW 

Pioneer F/G 



Radio Signal 





Patte m 



Pioneer design 


Jet Thrusters 

Lockheed 

Agena 



Table 4-18- Common Hardware Assemblies for Stabilization Systems 


ASSEMBLY 

REPRESENTATIVE 
MANUF ACTUR ER 

MODEL 

ACCURACY 
MtLLl RADIANS 
(DEC) 

COMMENTS 

Rate - Inte g rated 
Gyros 

Lockl.eed 

ARA 

1 . 7x 10” ^ m rad/ sec 
(0. J5° /hr) 

3 SDF. Kearfott 
2S64 Gyros 

Sun Sensor 

ADCOLC: 

1401 

4.H :0.25) 

3- Axis Vehicle 

Sun Sensor 

ADCOLE 

1301 

4.4 (0.^5) 

Spinning Vehicle 

Sun Sensor 

Bendix 

IB188^3 

0.024 (0.0014) 

Null Seeker 

Star Sensor 

TRW 

Pioneer F/G 
OAO 

8.7 (0.5) 

Solid State Scan 

Star Sensor 

ITT 

Bo re sighted 

(0.0011) 

Electronic Scan 

Earth Sensor 

Barnes 

13-181X 

I. (2) 

Radiation Balance 

Earth Sensor 

TRW 

AOGO 

1/0 (0.06) 

^-Axis Sweep Through 

Momentum Wheel 

Sperry 

45Q RWA 

{ 


61 newton-meter^sec 
(45 lb- ft- sec) 

Momentum Wheel 

Bendix 

l880^7^ j 


i. 8 newton-meter- sec 
(2.06 Ib-ft-sec) 

CMC 

1 

Bendix 

HEAO 

1 

611 newton-meter- sec 
(450 Ib-ft-sec) 

Jet Thrusters 

Lockheed 

AGENA 


0« 23 kg to 4. 5 kg 
(0. 5 lb to 10 lb) thrust 
repre sentati ve 
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an increase in total program costs. One recent study group (Ref. 13) 
concluded that standardization appears to be feasible in the Shuttle time 
frame when potential solar array design freedoms such as the relaxation of 
s 4.e and weight constraints become more practical. 

This study attempts to make a first-order estimate of the cumulative 
solar array cost savings that may be gained by means of solar array stan- 
dardization for Shuttle payloads. The weighty area, and cost of standardized 
and custom arrays are compared for several types of typical missions. 

1. SIZING OF SOLAR ARRAYS 

Table 4-19 summa^^izes the results of the solar array sizing analysis. 
Column 1 is a summary of the missions and types of solar arrays which 
are typical of earth -orbiting spacecraft using solar power systems. Average 
array temperature and charged particle radiation fluence given in columns 
2 and 3, respectively, are the major orb it -dependent environmental factors 
that affect array performance. For the customized arrays, a 10 Q-cm 
solar cell was selected for use for synchronous and 12 -hour elliptical orbits 
because of the more severe radiation environments compared to a low earth 
orbit. The maximum power point of single cells at the end of a mission 
(column 4) was determined from the calculated I-V curves shown in Figur..,s 
4-2 and 4-3. The number of single solar cells connected in series (column 
S) required for the array to operate at the maximum powerpoint is based on 
an array operating voltage of 28 volts. The area of each customized array 
is based on a nominal array output of 1 kw. This area scales linearly with 
power if array size at other power levels is desired. 

The standardized array must be capable of meeting the require- 
ments of several types of missions, even though some loss of performance 
would be expected. The series configuration of 71 cells was selected as 
the reference configuration for the standard module because this configuration 
would meet the performance requirements of all the missions considered. 

The size and weight impact of using the standard module was determined by 
calculating the I-V curve operating point for each mission, followed by the 
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Table 4-19. Sizing Results for 1 KW Solar Array 
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Cell Current, amps 



Figure 4-2. Solar Cell I-V Curves 
(10 £2-cm, 2X2 cm) 
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calculation of an array area for the mission. In estimating the weight impact, 

2 2 

a value of 7. 3 kg/m (1. 5 Ib/ft ) was used for both customized and standard- 
ized oriented arrays and is consistent with use of the Shuttle where array 

weight is not expected to be a major design constraint. For body-mounted 

2 2 

arrays, it was assumed that 3.4 kg/m (0.7 Ib/ft ) of substrate and structure 
were chargeable to the solar array. 

Table 4-20 lists those general characteristics of a standardized array 
which seem likely at this time. It is expected that relatively thick and large- 
area solar cells would be used to minimize solar cell and array fabrication 
cost* It is also expected that standard array modules would not be designed 
to maximize array power-to-weight ratio and, as such, would be constructed 
using relatively heavy substrate* The weight penalty incurred by the use of 
thick cells is partially compensated by the increase in cell efficiency with 
cell thickness (Ref* 14). Also, large area cells increase the array packing 
factor, which is defined as the ratio of active array area to total array area. 
Array structural design, however, also depends on thermal design and stiff- 
ness requirements* Further construction and material details, therefore, 
cannot be identified until standard cell and standard array specifications are 
developed which define these requirements* Table 4-20 also shows typical 
values for design parameters for custom arrays which been flown. 

2. POT^NTIALr COST SAVINGS 

The estimate presented herein of the potential cost saving realized 
from array standardization in the 1979-1990 time frame is a first-order 
approximation based on certain key assumptions concerning future solar 
array utilization in space and solar cell cost projections. In general, solar 
array cost can be subdivided into recurring and nonrecurring costs. Recurring 
costs include costs of materials (solar cells, covers, etc. ), fabrication labor, 
management support, and acceptance testing* Nonrecurring costs include 
design analysis, prototype and qualification testing, labor, and test equip- 
ment* Recurring costs tend to vary directly with the amount of flight hardware 
built, whereas nonrecurring costs, as a first approximation, are independent 
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Table 4*20. General Characteristics of Custom and 
Standard Solar Array Modules 
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of the amount of flight hardware built. A previous study (Ref. 15) has 
shown that array recurring costs tend to correlate relatively well with array 
area as opposed to maximum or average array power output. This correla- 
tion is used in the present analysis. 

The mission planning model summarized in Table 4-21 was used to 
estimate the cumulative solar array capacity required for DOD, NASA, and 
other Shuttle payloads over the 12-year period, 1979-1990. Using the results 

of the previous subsection, the average yearly production requirement for 

2 2 

custom versus standard array panels is 622 m /year (6700 ft /year) and 
2 2 

678 m /year (7300 ft year), respectively. 

The data shown in Figure 4-4 (Ref. 15) were used to estimate 

solar array recurring cost per unit array area. The recurring costs include 

the cost of materials, fabrication labor, test, and management and support. 

These data indicate that array costs per unit array area are reduced as 

larger units are built. For custom arrays, it was assumed that the array 

for each of the 42 spacecraft launched per year were procured individually, 

2 2 

so that the average procurement is 14.9 m /spacecraft (160 ft“ /spacecraft). 

This asstimption tends to maximize the cost per unit area, because some 

projects would involve multiple launches of identical array designs, and the 

2 2 

average procurement would exceed 14.9 meter (160 ft ). The average cost 

2 2 

for custom arrays is $75, 347/m ($7000/ft ), so that the total array recurring 
cost for the 1979-1990 time frame is approximately $570 million. 

The concept of a standard array module permits long-term purchasing 
and the stockpiling of modules by users or manufacturers. Under these con- 
ditions, the size of a single procurement by the user or a centralized agency 

wc "Id exceed that needed for a single flight project. It is assumed here 

2 

that NASA and DOD needs are equivalent and that each obtains 339 m /year 

2 

(3650 ft /year) of standard array modules as a single procurement. Under 

these conditions. Figure 4-4 shows that the recurring cost of standard 

2 2 

modules is $32, 300/m ($ 3000/ft ), so the total recurring cost fcr the 500 
spacecraft is $260 million. 
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Table 4-21. Solar Array Planning Model 


Time Period: 1979 - 1990 


Type of Solar Array by Orbit 


Relative Number of Launches 


Synchronous 

Body Mounted 
Oriented Panel 

Low Earth Orbiting 

Body Mounted 
Oriented Panel 

Elliptical 

Oriented Panel 

Average Array Area per kw^. Customized: 


Average Array Area per kw , Standardized: 


25% 

19 % 


19 % 

25% 


12% 

19. 1 m^/kw (205 ft^/kw) 
20. 8 m^/kw (224 ft^ /kw) 


Total Number of Spacecraft: ~ 500 

Average Array Power Output per Spacecraft: -.^780 watts 

Solar Array Requirements 

Customized Modules: 7, 430 m^ (80, 000 ft^) 

Standard Modules: 8, 080 m^ (87, 000 ft^) 

Cumulative Weight Penalty; 4.76 x lO^kg ( 10.5 x 10^ lb) 


1. Using Ts'ble 4- 19» Column 6 di. • 'le percentages above. 

2. Using Table 4-19, Column 7 data, and the percentages above. 
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Figure 4-4. Solar Array Recurring Cost 



Additional savings in solar array cost can be realized because of 
the expected reduction in solar cell costs, as indicated by the cuxve.^ 
in Figure 4-5. The savings are a result of the so-called ‘learning effect*' 
v'he’-e costs are reduced as the cell manufacturer gains experience in repet- 
itive manufacturing operations. The cost of standard cells would probably 
show a faster initial decline, since the standard cell would be the same as 
or very similar to a cell already in production and only cells of a single type 
and size would be produced. Using the Figure 4-5 data, it is estimated that 
custom cell costs would decrease an average of 14 percent during the period 
1970-1990, whereas the cost of a standard ctil is estimated to decrease an 
average cf 25 percent. The extrapolated portions of the curves in Figure 4-5 
are based on the assumption that no new soiar cell technology is introduced 
in the interim period. The learning curve for the standard cells is expected 
to flatten out around 1999, because by then the technology and manufacturing 
methods for their production would have been well established. Since solar 
cell costs are proximately 30 percent of panel cost, the average expected 
reduction of cost for custom and standard flight panels through learning is 
4 percent and 7 percent, respectively. Applying these percentage reductions 
to the recurring cost estimates developed above gives total recurring costs 
for custom and standard arrays of $550 million and $240 million, respectively. 

Potential cost reductions of other array component ■ resulting ^>om 
the learning effect have been neglected. This is justified on the basis that 
the production technology for array substrates and other electrical com- 
ponents is well established, and any potential savings can be neglecteu 
compared to the potential solar cell cost savings. 

Estimates of nonrecurring costs for customized and standard array 
modules are much mc^e difficult because of the general lack ;:tHiled 
historical cost data.. A rec^’nt stud/ (Ref. 16) has shown that : .irecurting 
costs range from 0 percent to 50 percent of total array cost an^® depend, to 
a large extent, on program requirements rather than technology require- 
ments. Major nonrecurring cost items include tho^^ associated with array 
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Revenue Per Unit, $/m ' 



Year 


Figure 4-5. Silicon Scla“: Cells Learning Curve 

jjc 

This figure was provided by E. L. Ralph of Spectrolab/Heliotek, 
a Division of Textron^ no calculated the projections shown. 
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Table 4-2 2. Solar Panel Cost Breakdown 


ITEM 

RELATIVE COST, % 

DESIGN ANALYSIS* 

5.0 

FABRICATION 


Labor 

20.0 

Material 

27.0 

Quality Control 

7.0 

Documentation 

6.0 

Management & Support 

13.0 

PANEL TEST 


Prototype* 

0.9 

Qualification Test * 

0.9 

Acceptance Test 

11.0 

Quality Control 

5.5 

Test Equipment* 

3.7 


♦ Nonrecurring cost items 
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design and analysis, prototype fabrication and testing, and test equipment. 
The potential savings that may be realized via standardization are even more 
uncertain. Tab' 4*21 shows relative array cost items for a current NASA 
program (Ref. 17'. These data show that approximately 10 percent of the 
total array co-<: can be considered as nonrecurring. In the present analysis, 
it is assumed that the nonrecurring costs during the period of interest are 
approximately lO percent of the total cost of customized arrays. For 
standard arrays, it is assumed that nonrecurring costs constitute only five 
percent of total array costs. Based on these assumptions, the estimated 
total nonrecurring costs for custom and standard arrays are approximately 
$60 million and 13 million, respectively. Total costs are summarized in 
Table 4-23. 

Table 4-23. Estimate of Total Solar Array Cost, 

1979 - 1990 


Item 

Customized 
Array, $M 

Standai d 
Array, $M 

Recurring Cost 

550 

240 

Nonrecurring Cost 

60 

13 

Total Cost 

610 

253 

Net Savings 


357 


D. CONCLUSIONS 

As anticipated, this study has indicated that commonality of attitude 
control subsystem hardware should be very advantageous for Shuttle payloads. 
Minimizing the number of different censors and actuators should result in 
large cost savings in engineering, manufacturing, test, maintenance, and 
repair. In addition, it should provide more reliable equipment having signi- 
ficant performance margins. 
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Common hardware should be employed on payloads having similar 
requirements. Candidates for common hardware were selected by first 
grouping types of missions (earth orbiting and earth pointing, for example) 
and then establishing subgroups with similar accuracies and weights. 

A total of 53 different payloads involving 177 flights was considered 
in the study* It appears that only 14 different types of attitude control sub- 
systems could accommodate all of these payloads. In addition, considerable 
hardware commonality would occur among sensor and actuator modules. 

The results of this study have also shown that the use of standard 
solar array modules during the 1979-1990 time period for several different 
types of mission projects could result in significant savings in solar array 
costs while incurring relatively minor array size and weight penalties. These 
results, however, hinge on several key assumptions which tend to maximize 
the cost of custom arrays and minimize the cost of standard arrays* These 
assumptions must be verified and modified, if necessary, in a more detailed 
analysis befo e a realistic appraisal of standardization can be made. The 
indicated cost saving potential of $357 million is great enough so that a more 
thorough investigation seems warranted. 

E. RECOMMENDATIONS 

Hardware commonality should be a basic policy for attitude control 
subsystems on Shuttle payloads. Design studies should be initiated on a 
minimum number of di.Aerent sensors, actuators, and interface electronics 
modules suitable for all anticipated Shuttle missions. In view of the cost 
savings which result from hardware commonality, it is recommended that 
the subsystem modules be identical for expendable, on-orbit repair, or 
retrieve /refurbish missions. An additional reason is that all subsystems, 
even those on expendable missions, should be checked out by the Shuttle or 
Tug when the payload is placed in its final orbit or in a parking orbit in 
order to insure that no malfunctions occurred during ascent. Commonality 
of spacecraft hardware will result in standardized checkout test equipment 
and procedures aboard the Shuttle or Tug and will p *mit replacement of 
any failed modules without bringing the spacecraft back to earth. 
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Based on the results of the present study, it is recommended that 
the feasibility and potential advantages of solar array standardization be 
investigated in more detail* Using the present results as a point of departure, 
this follow-on work should include the following: 

1* The feasibility of a specification for standard cells and/or 
modules capable of meeting the requirements of a wide 
variety of NASA and DOD missions 

2* The impact of array hardening requirements on the feasibility 
of standardization 

3* A detailed estimate of the potential nonrecurring cost savings 
resxilting from array standardization 

4* The effect of cell and/or array module standardization on 
the development and implementation of improved solar cells 
and module fat rication techniques 
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5. SORTIE PAYLOAD OPERATIONS 


A. INTRODUCTION 

It has been suggested that certain Sortie payloads in the NASA 
mission model may have substantially overlapping data requirements 
with other payloads and that a cost savings could be obtained by flying 
these pairs as joint payloads. One such pair is the combination of the 
Solar Shuttle Observatory (SSO) and the Atmospheric Science Facility 
(ASF) because the ASF requires substantial quantities of solar data for 
its own use. 

The first phase was to determine the instrument complement for 
a joint mission, the requirements this complement would place upon an 
integration facility (or facilities), and the orbital operations this comp.e- 
ment would demand of the astronaut and mission specialist. The joint 
mission could then be utilized to construct a general model of the require- 
ments the scientific instrumentation would place on integration facilities. 

Sortie modules, and specialists. 

The second phase examined the compatibility of the experiment 
equipment operations with the operational requirements of tLe Space 
Shuttle. This effort evaluated the experiment requirements, operational 
sequences, time lines, and facilities. 

Since results from the first phase showed ASF -SSO is not a useful 
combination, a modified Atmospheric Science Facility was selected to pro- 
vide a model for the integration facility impact study and the orbital opera- 
tion study. The modified ASF described here is not a current NASA de- 
scription. 

The modified Atmospheric Science Facility is based upon the 
Martin Marietta Corporation Study of au Atmospheric Science Facility (Ref. 19). 
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Since the Martin study was publ'shed, there have been continuing formal and 
informal critiques. The modified ASF attempts to incorporate many of the 
ideas expressed in these critiques and in discussions with Dr. R. D. Hudson 
of the Johnson Space Center. Conaments of the NASA working group review 
of the Martin study and a few ideas generated in the Space Physics Labora- 
tory of The Aerospace Corporation have also been implemented. The result- 
ing modified Atmospheric Science Facility is utilized to provide input data 
for the second phase of this study. The exact instrument complement is 
not vital to the overall study ince the final models are supposed to be gener- 
al guidelines for planning purposes. Consequently, the modified Atmospheric 
Science Facility has not been submitted to Dr. Hudson for explicit approval, 
though the concept has been approved for the purpose of this study. The 
modifications are made to utilize a payload which is somewhat more complex 
and therfore more like other payloads, involves man to a greater degree, 
and should be more nearly representative of the final concept of this evolv- 
ing facility. 

B. ANALYSIS OF A JOINT ASF/SSO PAYLOAD 

The analysis of a joint payload concept for these two missions 
includes a determination of potentially coi imon instrumentation, data- 
collecting techniques, and orbital requirements. 

A summary of the ASF instrumentation is given in Table 5-1. This 
table inrludes an XUV-UV solar intensity monitor and a high-resolution 
solar emission line spectrograi'>\. 

Table 5-2 lists candidate instruments for inclusion on the SSO. 

This list is taken from Reference 19 and includes an 0. 3-m telescope and 
associated spectroheliograph for the ultraviolet as well as a 0. 5-m telescope 
and associated spectroheliograph for the extreme ultraviolet solar radiation. 
When the SSO instrumentation is casually inspected, it appears that all of 
the instrumentation would be useful to the ASF experimenter. However, the 
astronomer is interested in very small regions on the solar disc. If the 
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Table 5-2. Candidate List for Instruments for 

Inclusion on a Solar Shuttle Observatory 



178 



field -of -view (FOV) requirements on the SSO ultraviolet instrument are 
compared with the solar disc area, it can be seen that a raster scan and 
summation of ~ 64 FOV elements would be required to provide the solar 
disc total energy. The UV monitoring function or the ASF facility requires 
about 370-m (0. 2-nmi) resolution, but the SSO would yield 1. 9m (0. 001 nmi). 
In order to obtain intensities over a full line width for ASF purposes, either 
the SSO instrument focusing properties must be degraded, thereby making 
the data worthless to the solar astronomer, or the data must be obtained by 
scanning and summing the full width of the line at each of the 65 FOV element 
locations. If the data were to be used by both facilities, the solar astronomer 
would not be able to continuously monitor a small active region on the sun, 
and the ASF experimenter would be faced with an extraordinary data storage 
and handling requirement. 

Another aspect of the problem is one of spacecraft stability. The 
jitter requirement for the SSO is very tight (0. 015 arc-sec/sec with a point- 
ing accuracy of 0. 5 arc-sec). The ability of the Sortie Lab to accomplish 
these taks is marginal at best; it is certain that several groups of ASF 
instruments would not be permitted to slew from one look direction to another 
during solar operations. 

Table 5-3 illustrates the SSO instruments field-of-view requirements 
which are not consistent with the ASF requirement for full solar disc data. 
Table 5-4 provides a comparison of the spacecraft attitude requirements. As 
can be seen in Table 5-4, the ASF instrumentation would generally be in 
motion in order to compensate for spacecraft orbital motion, which would be 
detrimental to the solar physics data. The Orbiter pointing capability is 
expected to be sufficent for the ASF facility, but the SSO will require special 
image motion compensators as well as one more stage of pointing control 
beyond the experiment -pointing base. 

Other areas of incompatib:Tity are the desired orbit capability and 
the cleanliness requirements. The SSO facility cannot properly operate near 
185km (iOO nmi) because of atmospheric absorption. The SSO requires 
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Table 5-3. Solar Shuttle Observatory Instrument 
Field of View 


Instrument 

FOV 

Purpose 

Coronograph 

15° 

1 sec resolution of solar 
prominences at the solar limbs. 
Flares at these locations are 
less important to earth phenomena 
than flares from more nearly 
central locations. 

Flare Detector 

Full disc 

Identify and study active regions 
and flares. 

EUV Spectrograph 
UV Spectroheliograph 
X-ray Spectroht. io- 
graph 

Visible Spectrohelio- 
graph, etc. 

5 min 
4 min 
4 min 

4 min 

Scan over the disc and sum the 
results ^64 FOV elements; 

i. e . , 10^ words. These would 
provide spectral line profiles and 
total flux data. 


180 





Table 5-4. Comparison of Requirements 
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500-km (270-nmi) orbit thus reducing performance margin for instrumenta- 
tion which can be carried. The ASF can operate near optimum at 185 km 
(100 nmi). Additionally, the SSO requires the orbit to provide mimimum 
eclipse time; the ASF would utilize that orbit once but, for subsequent 
missions, would require different launch times. The SSO also has a stated 
requirement for contamination care that would seriously impact the cost of 
preparing the ASF instrumentation. 

The most basic compatibility problem is one of data collection. 

The solar physicist wants high spatial resolution to follow the growth and 
decay of very small active regions on the sun. He would select those por- 
tions of the solar spectrum which provide information on solar processes. 
Tiiese specific spectral lines would be monitored in very high resolution 
in order to measure line widths which permit the calculation of temperatures 
and velocity fields. In contrast, the atmospheric scientii*' wants the total 
radiance from the entire solar disc that falls upon the earth. The spectral 
information required is much more coarse, since the atmospheric absorp- 
tion of solar energy is due mostly to continuum absorption processes. Those 
relatively few cases of absorption resonance or accidental resonance for 
which solar line widths, shapes, and intensities are required are in ge.'eral 
found at wavelengths of lesser interest to the solar physicist. Con. ''quently, 
we find that the spatial resolution, time history data, and spectra’ <-i<ita 
required by the two facilities aro not complementary. 

The two facilities might still occupy the same Sortie Lab as two 
strangers might occupy the san apartment building; they would share the 
same plumbing but would not reinforce one another's productivity. In fact, 
each one interferes with the other. The incompatibilities are summarized 
below : 

1. The SSO separately records 64 FOV elem ts and ~ 10^ 
resolution elements which require summa.-on for ASF 'urposes. 

2. The wavelengths chosen for observation by the solar physicist 
for solar studies miy be irrelevant to ASF purposes. 
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3. Time sharing between the ASF ’’scan and sum” mode and the 
SSO ’’set and rerord each spatial element” mode is impractical 
on a seven-day mission since the main ASF experiments re- 
quire simultaneous solar disc data. 

4. The high resolution elements f SSO experiments are very 
costly ana not required by ASF. ~ SSO instrumentation is 
essentially wasted when used for ASF purposes rather than for 
colit -ting solar physics data. 

5. The SSO experiments ought to all be flown r.© fo-oup including 
the very large visible region telescope; the combined payload 
cannot all fit in a single Sortie nd reach 500 km (270nmi). 

6. The local time of ascending i-otl* acceptable to the SSO (maxi- 
mum sunlit orbit) in a 55 d' .ciined orbit is only one of 
several orbits the ASF would lik: to attlize in subsequent 
missions. If given a life expectancy cf six missions, only one 
of these is compatible with the SSO. 

C. THE MODIFIELD ATMOSPHERIC SC ENCES FACILITY 


In line with the philosophy expressed by the report of the Atmospheric 
and Space Sciences working group, (Ref. 20; the scope of th ASF was expanded 
to include ©.ctive experimentation with the environment, more emphasis on 
solar-terrestrial relationships, and provision for monitoring stratospheric 
and mesospheric minor constituents. 

The objectives chosen for he expanded ^itmospneric Science Facility 
a^e as follows: 

1. Established the effects of s^^ar variabUity as a function 
of wa^'clength 

Photoicnization rates 
Photodissociation rates 

Tv niperature and resultant chfiniical quilibrium 
changes; e. g. , 0^ ion dens'tv 

2, Establish remote sensing techniques including the addition 
of a vertical component to satellite data 

Coruposition and its variability 

Av^rcsols 

Pollutants 
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3. 


Investigate active chemistry with the upper atmosphere 

Determine the exited -state population of the 
ambient atmosphere 

Determine the role played by minor constituents in 
the chemical equilibrium 

4. Determine diffusion rates 

Establish the eddy diffusion c sncept on a firm 
experimental basis 

Establish the facts about local contamination around 
a manned spacecraft 

Establish the size and dynamics of the spacecraft 
wake, bowshock, etc. 

In order to accomplish these objectives, instrumentation has been 
added to the ASF as listed in Table 5-5. The most important departure is 
the slave satellite which permits simultaneous "in situ" measurements with 
its own instrumentation and absorption, resonant scatter, or emission 
measurements with the Sortie Lab instrumentation. This permits a real 
evaluation of the possible contaminant cloud surrounding the Sortie, the 
effect of the Sortie wake, etc. The slave Satellite, which carries both 
corner reflectors and laser detectors, can also be used for absorption 
measurements between itself and the Sortie Lab independent of the solar- 
zenith angle. The basic model of the slave adopted for this study is the 
Atmosphere Explorer C spacecraft (Figure 5-1). It should be noted that the 
plasma lab Sortie studies also contemplate use of a slave satellite. 

The other instrumentation worth special note is the Light Detection 
and Ranging (LIDAR) unit which is a laser utilized for studies of aerosol 
scattering. With the LIDAR and the UV laser, it is likely that remote 
sensing of lower atmospheric pollutants and minor constituents can be 
studied. 

It is not the purpose of this report to define the instrumentation in 
detail but rather to assess the requirements that a Sortie payload places on 
an integration facility and on orbital operations. Therefore, the modified 
Atmospheric Sciences Facility is not developed further. 
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Table 5-5. Added Instrumentation for the Modified ASF 
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Atomic Mass Unit 




A Slave Satellite 



D. INTEGRATION AT A SORTIE CENTER 


The concept of the Sortie payload system is that as a universal 
Sortie Lab module and pallet become available at an integration center 
(probably a launch site)* a pre -built, tested, qualified, and calibrated group 
of instruments at the integration site is ready for mating to the pallet. The 
interface is a simple design with no complex alignment procedures required. 

The packages and the operations required to integrate them onto the 
Sortie Lab pallet are listed in Table 5-6. The man-hour estimates are 
based upon actual operation times and do not include possible delays between 
operations due io scheduling of people, documentation, quality assurance 
checks, or on-the-job training. An iiK rc ase of 50 percent in time is some- 
times required, depending upon the contr^c^or and operational philosophy of 
the management group. The operational times listed are considered realistic; 
they are oaf d on *:urrent experience uncrating and checking existing satellite 
instrumentation, time required for installation of consoles in the Sortie 

Lab is a re^^scnabh^ estimate based on design expectations. It is possible 
that this operation could take much longer if the interface cabling design 
were not carefully worked out in advance. The times indicated should be 
conser'^ative for a Sortie Lab integration after the process has become 
routine. 

E. ORBITAL OPERATIONS 

A series of typical experiments has been blocked out for the purpose 
of helping the systems designer understand what the scientist would like to 
do. The operator duties in Table 5-7 are described as if they were performed 
by a scientist and/or a highly trained technician. The total work time is 
estimated at 200 hours over the 6 -day period. The time lines are shown in 
Figure 5-2, and they are tight for two men because the average work day is 
16. 5 hours. This tight scheduling is based on a number of observations: 
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Table 5-6. Integration Data at a Sortie Center 
(Probably a Launch Site) 
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ie Center (Probably a Launch Site) (Continued) 
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Table 5-7, Orbital Operations (Continued) 
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1. Scientists spend very long hours in the laboratory when exciting 

experiments are reaching fruition. It is not likely they will 
change character and work an eight-hour day on a seven-day 
mission, and it is equally unlikely they could be taken *■ . ■■>m 

the consoles during their waking hours. 

2. This mission profile is presumed to be a first or survey ASF 
mission in which many techniques will be tested for future 
development where legitimate and useful data for scientific 
purposes are also obtained. 

3. Each of the instruments is sufficiently automated that the 
scientist must spend most of his time in monitoring data, in 
quick analysis, and in selecting detailed modes of operation. 

He should not be required to manually operate equipment 
normally. Therefore, time for eating, coffee breaks, etc. is 
available within the allotted time elements, and experience 
shows that many meals are taken at the desk or in the labora- 
tory during intense data-recording runs. 

The addition of . third man would reduce the average work day to 
11 hours. He would also be useful to relieve some of the strain from the 
other two and provide a third party to discuss data which can be very bene- 
ficial. The time lines shown should be considered the maximum schedule 
possible. 

The operations listed are not necessarily those for an actual flight, 
but they should be useful to the system analyst in understanding the potential 
desires of orbiting scientists who may be expected to approach problems 
somewhat differently than astronauts. 

F. GROUND OPERATIONS 

The upper level integration flow cycle for the Shuttle, Sortie Lab, 
and experiment is shown in Figure 5-3. The ground operations for the 
Sortie experiment start at the lead center and end after landing and removal 
of the equipment. The operations where the experiment will interface with 
the Sortie Lab occur during experiment installation, orbital operations, and 
experiment removal. The experiment interfaces with the Sortie Lab, and 
the Sortie Lab interfaces with the Orbiter. The orbital configuration of the 
modified ASF is shown in Figure 5-4, and the experiment equipment list is 
shown in Table 5-9. 
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Figure 5-3, Pa>. i Operati(>ns Flow Cycle 
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Table 5-8. Experiment Equipment Main Assemblies 
and Complementary Equipment 
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The lead center serves as the starting and focal point for all of the 
experiment equipment. Individual instruments and their controls will arrive 
from manufacturers, research agencies, or other sources. The lead center 
can mount the instruments in the appropriate gimballed main assembly and 
their controls in the control consoles. The control consoles will then be 
attached to the Sortie Lab Module standard fittings. All experiment equip- 
ment can be physically mocked up in the flight configuration. The Sortie Lab 
data collection and storage system, the electiical power, and environmental 
control systems should be available for integration checkout. Interconnecting 
electrical harnesses should be fabricated and certified. Preliminary mass 
properties data can be determined if required. The experiment equipment 
should be aligned, the calibration established, and a complete performance 
verification conducted with the Sortie Lab. It was assumed that the experi- 
ment is capable of performing on-orbit calibration so that ground calibration 
at the launch site would not be required. 

Upon completion of the lead center operation, the experiment equip- 
ment would be disassembled to the main assembly level as listed in Table 
5-8 for shipment to the launch site. 

For integration of the experiment equipment with the Sortie Lab 
at the launch site, the installation of the instrument assemblies on the pallet 
and the control consoles in the Sortie Lab module should be done simultaneous- 
ly on a no -interference basis. However, work in the Sortie Lab module 
should be planned serially as should the pallet installation activities. Using 
this approach, the operational sequence and time lines for the experiment 
installation and checkout operations are shown in Figure 5-5 for the Sortie 
Lab module and in Figure 5-6 for the pallet. It can be seen that about nine 
single-shift working days are required. The checkout times shown include 
verification of the interface to the data collection and storage equipment of 
the Sortie Lab module. 

The checkout of support equipment items is defined as end-to-end 
type verification where known signals are inputted and the outputs are 
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Figure 5-5. Instrument Integration Time Lines 
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Figure 5-6. Control Consoles Integration Tinrxe Lines 




monitored. A special test console (built and checked at the lead center) 

should be the most efficient approach. Special handling equipment to 

position the assemblies will be required. No unusual facility requirements 

are foreseen. Facility floor space needs for integration would be met by the 
2 2 

557m (6000 ft ) that have been identified in Reference 21. An overhead 

crane of 907 -kg (2 -ton) capacity with a clear hook height of 9. Im (30 ft) 
should be adequate. 

The expendables and servicing items are conceived to be: 

1. 40 rolls of Polaroid film 

2. 10 rolls of strip-chart recorder paper 

3. 1 roll of film for each UV documentation camera 
on the general purpose spectroscopy unit 

4. One bottle 

The first three items can be stored during the integration activity. The LN^ 
bottle should be installed just prior to installing the Sortie Lab to the Orbiter. 

The personnel for this operation are two crews of two technicians 
each: one crew for control console installation in the Sortie Lab module and 
the second for instrument installation on the pallet. It is expected that four; 
men would be augmented by the mission and payload specialists who would 
assist in checkout activities and problem resolution. Thus, a total crew of 
seven, intimately familiar with the experiment equipment and assisted by 
launch-base personnel, is anticipated. No further ground operations devoted 
to verifying experiments which are planned prior to launch. 

After return from orbit, the Sortie Lab is removed from the Orbiter 
and transferred to the payload facility for removal of the experiment 
equipment. The facility and personnel requirements are the same for experi- 
ment equipment removal as for integration. Operations for removal are 
expected to be similar in that work will be done concurrently on the pallet and 
in the Sortie Lab module. The removal time is expected to be about the 
same as the mechanical installation time (with no checkout). On this basis, 
the time required for removal of the experiment equipment is five working 
days, sequenced and timed as shown in Figure 5-7. 
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Figure 5-7. Experiment Equipment Removal 




G. SORTIE PAYLOAD CAPABILITY 

The combination of the Solar Shuttle Observatory and the Atmospheric 
Science Facility was determined to be incompatible because the two Sortie 
missions are not mutually supporting, have different orbital requirements, 
and interfere with one another's operation. Since these payloads were 
incompatible, it was necessary to develop a model Sortie payload for the 
study. For this model, the Atmospheric Science Facility was modified to 
incorporate more recent research requirements. The description of the 
modified version was provided in the scientific orbital operations for use in 
modeling a standard mission. 

The modified Atmospheric Science Facility representing the 
standard mission was found to be operationally compatible with the existing 
definition of the Sortie Lab (Ref. 22) and Space Shuttle (Ref. 23). An 
operational comparison of the Shuttle and Sortie Lab capabilities and the 
experiment requirements are summarized in Table 5-9. The resulting 
compatibility appears due to the nature of the equipment design concept. To 
provide this compatibility, the experiment equipment should include the 
following design features: 

1. Experiment hardware interfaces with the Sortie Lab only 

2. On-orbit alignment and calibration capability 

3. Experiments delivered assembled at the launch site in flight- 
ready condition 

4. Minimum servicing and expendables 
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Table 5- 9. Evaluation of Operational Compatibility 
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APPENDIX A. STRUCTURAL DESIGN 


This appendix is an attempt to generate general design criteria 
and guidelines for low-cost flightworthy structure in terms of design safety 
factors by a rational approach which maintains adequate structural integrity. 
It is primarily a discussion on promising alternatives to procedures which 
are now almost traditional for weight-optimized structure development. In 
this form, it is intended to stimulate further cost reduction thinking when 
applied to specific designs to be developed by particular engineering and 
fabrication facilities. 

The diversity of current viewpoints on the actual utility of safety 
factors and the proper nvimerical values which are appropriate for any par- 
ticular mission will prevent unanimous agreement on any recommended 
values. The recommended safety factors resulting from this analysis are 
therefore recognized as being somewhat arbitrary, reflecting the judgment 
and experience of The Aerospace Corporation. They are intended as starting 
point values to be modified as low-cost experience is gained or as other 
data becomes available. 

Results of this effort are also summarized in Appendix B in a form 
familiar to potential hardware developers. This appendix is typical of 
material supplied for inclusion in the work statement for a ntunber of DOD 
programs and is in the form of sample general structural design criteria. 

The criteria are intended to form the basis of and provide direction for 
the detailed criteria to be developed by the structure subsystem developer. 

A. ASSUMPTIONS 

It is assumed that the requirements for safety and reliability of the 
payload structural subsystem do not decrease for Shuttle -launched payloads. 
Considerations of Shuttle and personnel safety alone require that the payload 
be designed to prevent damage or injury. Payload structural reliability 
(the characteristic which is defined here as perfoiming an Intended function) 
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also must be maintained throughout the specified design life due to the im- 
practicability of performing on-orbit spaceframe repairs. It is assumed 
that it is not cost effective tc purposely design structure to a specific failure 
rate bf»cause of the Shuttle trip costs* These assumptions are reflected in 
design goals of no performance degradation^ rupture, or ccllapse during 
design life at limit load and the requirement to demonstrate the existence of 
specified design safety factors by test or appropriate analysis. 

It is a basic premise that safety factors do not attempt to allow for 
overloading or any other anomalous environmental condition. If performance 
margins are necessary or desirable, appropriate adjustr:!ients should be made 
to the specified limit or design conditions. 

The following development also leads to the implicit assumption that 
the purpose of design safety factors is to account for differences in strength 
capability between test and flight hardware. In the case of structure which 
is not test- verified, safety factors must be increased to encompass unavoid- 
able uncertainly in analyti'^al strength prediction. 

B. ANALYSIS 

1. GENERAL 

To explore the cost reduction potential associated with over-designed 
structure, it is illustrative to first examine the function of safety factors as 
currently applied by the aircraft and aerospace industries. These industries 
share the requirements placed on structure of extremely high reliability and 
safety, because of the very high costs associated with failure, and minimum 
practical weight, because of relatively high transportation costs. These 
requirements have been met quite successfully through development and 
inspection programs which involve extensive analysis effort, complex fab- 
rication methods, rigorous quality specifications, and static test qualification. 
Expensive, but cost effective, structure is the result. 

If transportation costs become less sensitive to weight, as with 
Shuttle- launched payloads, it is possible that a heavier structure may be 
designed which is lo^^er in cost. There are two basic ways that this type 
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of cost reduction may be accomplished: by under-optimization and/or by 
over-design. It is important to recognize that these are almost totally 
independent approaches to cost reduction. This study primarily addresses 
over-designed structure. 

2 . UNDER- OPTIMI ZATION 

Relaxation of weight constraints immediately suggests that the 
design and fabrication effort associated with weight optimization be reduced 
or even eliminated. Most of these cost-avoidance areas are obvious and 
have been adequately reported in the literature. T**'?^* al of these approe.ches 
is the use of less efficient structural materials (Ic ?ost, higher veight 
per unit of load-carrying capability) and eliminatio material removal 
in lower stressed regions of each structural element (less machi:iing« chem- 
milling, lightening holes* etc.)* Additional cost savings are realized 
through associated reductions in analysis complexity* development testing 
of exotic materials* problems with flaw sensitivity of highly tempered 
metals* and so on. All of the cost savings in the category of under-optimiza- 
tion are direct trades of cost and weight and do not generally improve safety 
or reliability. 

3. OVER-DESIGN 

Over-designed structure involves a general increase in strength 
by increasing the size of load-carrying structural elements. One rational 
way of allocating extra material through the structure is by the applicatic’^ 
of increased factors of safety. This approach will increase hardv, re uosi 
and weight but offers potential overall cost savings by reducing development 
costs associated with qualification analysis and test. For example* if 
safety factors are made sufficiently high* it may be possible to eliminate 
static testing completely without sacrificing reliability and safety. Inter- 
mediate safety factors may allow simplified testing. The potential savings 
associated with over-designed structure can only be determined by detailed 
cost analysis of a particular design; however* a feeling for this potential may 
be obtained from a simple consideration of approximate costs. 
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Structural subsystem weight for lightweight payioads approxi- 
mately 15-20 percent of the total pay)oad weight. Even for < ry large 
satellite in the 5, 000-kg (11,000-lb) category, a yield factor .safety of 
three could be achieved for less than a (0. 2)(5, 000)(3- 1) " 2, OOJ-kg (4,400-lb) 
increase. At a material cost of less tl-an $42.(T»0/ke; ($0,90/lb) (aluminum 
alloys), a $4,000 investment offers the possibility j{ eliminating a static 
test and test hardware costing $100,000 - $200,000. Against this must be 
traded whatever addition^ effort is required, perhaps engineering analysis. 

It is apparent that to continue this type of estimation it s necessary 
to determine factors of safety which will allow this or other approaches to 
structure qualification. It is also necessary to define more accurately the 
requirements placed on analysis and quality control by this approach, 
particularly if they differ from current requirements for ^est-qualified 
lightweight structure. To this end, an umlersvanding of the real function 
of safety factors, as now utilized, is necessary. 

4. SAFETY FACTOR UTILITY 

Examination of the intended function of safety factors necessary 
for an understanding of their relationship to testing, quality control, and 
analysis is difficult because of the many interpretations currently popular 
within the industry. There is seldom agreement even within a single 
organization as to the function of safety factors. Various designers and 
analysts consider their purpose is to cover ignorance and/or error in an 
assortment of areas including hazard, load uncertainty, material un- 
certainty, process variations, and analysis inaccuracies. Insight *nto 
the actual role of safety factors may still be gained, however, by examining 
one of the several rational design approaches now being used. An ideal 
approach, from a weight, schedule, and reliabilir.y standpoint involves the 
following basic tasks: 

a. Establish upper-bound loads including dynamic loading 
effects (limit loading) 
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b. 


Determine upper-bound critical stresses for limit loads 
and ultimate loads (product of limit load and safety facto rl 
(This may be accomplished through a combination of rigorous 
analysis, conservative assumptions, and experimental analysis.) 

c. Size each structural element using lower-bound element 
capability so that yielding does not occur below limit load 

and rupture does not occur below ultimate load. (Performance 
of this task presumes a knowledge of minimum material and 
assembly quality based on purchase specifications, process 
control, and inspection.) 

d. Qualify the design by applying limit and ultimate loads to a 
prototype structure 

e. Control the quality of all subsequent units to a level consistent 
with the specified design safety factors. 

Figure A-1 is a simple illustration of the variables involved in a deterministic 
establishment of safety and reliability. The ordinates plotted are applied 
loads and load-carrying capability which have been normalized to limit 
loads. As such, they are safety factors by definition. Yield and ultimate 
factors of safety are shown in four general categories: those specified as 
design requirements, those theoretically attainable, those actually present 
in fabricated structure, and those vdiich are demonstrated by static test* 

The xange in theoretical safety factors is the result of expected variations 
in strength of the actual design where the upper limits correspond to 
^'perfect** fabrication from materials which happen to have upper-bound 
strength characteristics. The lower limits correspond to the minimum 
strength which could result within the adopted material specifications, 
fabrications, fabrication methods, process controls, and inspection require- 
ments. Theoretical safety factors are a characteristic of the design and 
its quality specification only and are not directly affected by any strength 
analysis which is conducted. If the design is based on analysis, however, 
an inadequate design may result from analytical errors. Actual safety 
factors are a characteristic of specific hardware and the conformance of 
quality control to quality specification. If the previous design tasks are 
conducted rigorously, as would be necessary for weight efficiency, several 
fundeunental relationships may be deduced from the figure. 
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A successful limit and ultimate load test of the prototype establishes 
the load-carrying capability possible uith that particular design. The test 
article is probably damaged by the test, however, and its subsequent utility 
as a flight article is not known. Payloads designed to these safety factors 
normally require a dedicated test article to verify the design. 

Structural capabilities of each untested flight structure will be 
generally different, resulting in the ranges indicated. The lower bound 
of these ranges is known only if there is adequate quality control and 
conservative stress analysis. This family of structures meets the estab- 
lished requirements; some exceed these requirements bec.*use of the appli- 
cation of conservative stress analysis and the unavoidable variations in 
fabricated hardware. In this ideal case, the real utility of a design safety 
factor is simply to provide an arbitrary, pre-specified element of safety 
in the event of overloading, wlhout necessarily contributing to reliability. 

It does not compensate for uncertainty in limit load detemiination, quality 
control, or stress analysis. The mean safety and reliability for the family 
is higher than required, but by an amount which is not known. This is 
certainly a desirable feature, and if the family is large enough, it may 
be possible to statistically evaluate the consequences of errors or anomalies 
in determination of limit loads. Nevertheless, this additional safety is 
the result of material and process variations and design conservatism 
rather than the application of safety factors. 

Turning away now from idealistic situations, it is pv/»»ibie to 
arrive at the relationship shown in Figure A- 2 through a combination of 
the selection of an upper-bound structure for test, inadequate quality 
control, and/or stress analysis errors. If the test article happened to 
be the best of the family (quite possible with prototype hardware), the 
design requirements are not met except for the test article, and this 
fact will not be known prior to flight, a his situation arises either because 
the upper-bound stress was under- determined or because the lower-bound 
capability was over-stated, but the end result is the same. P^rfomiance 
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degradation may rosult in varying degrees in critical flight strv cture 
alignment. There will exist an unknown, reduced element of safety. It 
even more serious errors exist in the analysis, *^his will become apparent 
through test failure, and corrective design modifications will be required. 
Finally, if more serious quality control lapses occur, it is possible to 
unknowingly arrive at a state shown in Figure A- 3 where hazar^'^us ^^'ght 
failures will occu'. 

There are many other consideralic:\:5 a. ^he actua! ’»^eIopment and 
qualification of flight hardware such as othe .* t nvi ronmental effects, life 
requirements, component tests, etc. It is believed, however, that the 
following general conclusions may be drawn for wei ht-optimized structure: 

a. Flight structure safely (the ability to sust^lln limit loads 
without rupture or collapse) is established by the design 
ultin'iate safety factor, prototype test to ultimate load, and 
quality control which insures that all structures are at 
least 80 percent as capable as the prototype. 

b. Flight structure reliability (the ability to perfomi its in- 
tended function in the design environment) is a function 
of the prototype test, degret' of conservaiism or error 

in the structural analysis, and quality control level. Some 
degradation in performance may result from either uncon- 
servative analysis or inadequate quality control. Reliability 
is established only if all flight structure is the same as, 
or better than, the test article- Fortunately, variations 
in yield capability are usually much less than variations 
in ultimate capability. Most payloads are not affected by 
mino- yielding of primary structure, and even alignment- 
critical payloads can tolerate local yielding with only minor 
effect on mission quality. It is for these reasons that 
relatively small yield factors of safety (1.0 to 1.1) are 
used. It is then concluded that reliability is established 
within tolerable limits by test and quality control. Conser- 
vative design analysis will sometimes compensate for poor 
quality and vail enhance reliability at the expense of weight, 
but some conservatism cannot be specified quantitatively 
or evaluated, analysis is not a definable contributor to 
reliability. Unconse rvalism in the analysis may lower 
mission quality but not below acceptable limits. Analysis 
errors which would result in unacceptable performance are 
detected by prototype tests. 
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c. Testing establishes the safety and reliability of the design* 

d. Quality control establishes the safety and reliability of the 
untested flight hardware, and must be consistent with the 
safety factors utilized. 

e. Analysis has only a minor and undeterminable effect on 
safety and reliability* Its primary function is to speed 
convergence of the design by eliminating excess weight 
and avoiding test failures, thereby reducing the develop- 
ment schedule. Analysis may be required for test planning 
and limit load determination, however, for complex structure 
governed by inertial response to transient events. 

1* Accurate limit loads are essential. There is no allowance 
in the development or qualification for the payload structure 
to sustain overloading. 

g. Safety factors for lightweight structure contribute to safety 
but not reliability (since the yield factor is 1.0) and do not 
compensate for errors in the design analysis, limit load 
determination, or quality control. 

h. Analysis errors lead to test failures. 

i. Quality control errors lead to flight failures. 

In general, then, it is seen that trough test program and rigorous quality 
control are essential to hardware qualification. Most organizations also 
prepare more or less rigorous design analyses to prevent schedule problems 
and possibly for other reasons not directly related to schedule or quality 
control. As safety factors and weight are increased, potential reductions 
in tnese three areas of effort may be examined: analysis, test, and quality 
control. There are probably optimum values of design safety factor and 
upper bounds certainly exist, and it is these values and ihe corresponding 
requirements which are of interest. 

5. INCREASED SAFETY FACTORS 

If safety factors are increased above the values currently utilized 
for lightweight expendable payloads and other development and qualification 
procedures remain unchanged, there will be an increase in weight and in 
associated cost for the extra material. Any increase in strength will result 
in improved safety and reliability (the structure will be safe and reliable, 
for design loads as well as loading above limit load) or, alternatively, will 
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allow larger strength deviations between the test and flight structures. 

If it is assumed that limit loads for the Shuttle are adequately known by 
whatever means are required, there is no particular need for an improve- 
ment in safety and reliability. The possibility then exists of reducing the 
effort normally devoted to controlling strength scatter; neonely, the speci- 
fication of close drawing tolerances on dimensions and straightness and 
rigid specifications on procurement, process control, and inspection. 
Lumping this effort into the category of quality control. Figure A-4 shows 
the relationship between prototype-demonstrated safety factor and allowable 
strength scatter to prevent failure of untested flight hardware at limit load* 

Figure A-4 also shows that considerable reduction in quality 
control effort can be obtained with modest weight increases. For example, 
an ultimate factor of safety of 2 increases the structure weight by less 
than 60 percent (going from F.S. = 1.25 to 2.00) and the satellite weight 
by less than 12 percent (depending on structure type) while increasing the 
the allowable strength scatter by 150 percent (from 0.2 to 0.5). It would 
appear that assuring quality of only 50 percent of perfect would involve 
very minimal effort compared to that currently exerted to obtain 80 percent 
quality. 

The curve in Figure A-4 also applies to yield factors of safety, 
except that control of yield or deflection requires even less quality control. 
Prototype test-qualified structures thus appear to offer a promising tradeoff 
between weight and quality control effort. This is a trade which should be 
considered by the spacecraft contractor, based on his knowledge of current 
costs and consideration of alternate techniques which will assure quality, 
but within larger bounds. 

In addition to increased weight and potentially lower quality control 
costs, there will be other associated changes which also require considera- 
tion. Test activity will remain the same as for lightweight structure except 
that larger loads, consistent with the higher safety factors, must be applied. 
Design analysis, for whatever purpose it is normally done, is not increased 
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Allowable ultimate strength deviation between test article 
and untested flight articles. 

Figure A-4. Prototype Test-Qualified Structure 
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or decreased in scope* There will be a non-recurring effort required for 
each contractor to determine new procedures in procurement and inspection 
to provide consistent quality at a lower level. There will also be a slight 
increase in the cost of fabricating and joining heavier structure as well as 
a potential for nominal schedule improvement related to simplified procure- 
ment and inspection. 

This approach does not imply that carelessness is now more 
tolerable. It merely allows simplified techniques by increasing acceptable 
limits on dimensions^ material flaws» and workmanship quality. A side 
benefit of fewer rejected parts and less salvage activity will also be realized. 

A second costAveight trade becomes possible when both yield and 
ultimate factors are increased to a level somewhat above 1.25, if it is also 
required that no structural yield or damage result after application of test 
loads. The required design and test factors must be determined by con- 
sideration of cyclic loading and life requirements so that the test demon- 
strates a factor of safety of 1.25 after the test cycle. This approach will 
provide a step reduction in program cost by allowing flight of the test item. 

Flight use of the test article will require that the test be sufficiently 
instrumented to detect any permanent reduction in capability. An increased 
dependence on the design analysis may be required to identify critical areas 
for instrumentation. Post-test inspection will be required, and special 
considerations are necessary so that loads may be a^ died without alteration 
of the structural design. Cost benefits will be approximately $45. 00/kg 
($20/lb) for fabricated aluminum payload structure, less any additional 
test and analysis cost. 

These two approaches, reduced quality control and re-use of the 
test article, may be combined. Doing so suggests another possible economy: 
testing to a level above the 1.25 limit but below the design value. This will 
reduce test failures associated with design errors, a benefit whose worth 
must be evaluated by each particular design organization based on their 
test experience and design confidence. 
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One-of-a-kind payloads would seem to benefit most by such an 
under-test approach, particularly where development schedules are short. 
Structural safety and reliability for programs with a single payload are 
not determined by quality control or analysis but by direct demonstration. 

In che preceding discussion, it is noted that confidence in the 
safety and reliability of the test article is higher than for untested structure 
by removal of the reliance on quality control. Therefore, the possible proof 
or acceptance testing of each structure should be explored. The large costs 
normally associated with qualification tests would almost certainly result 
in total cost increase unless ways can be found to simplify acceptance tests. 

It would seem that the most promising way of simplifying testing would 
involve changes to the basic structural design. If the structure is designed 
to an enveloping test condition rather than flight conditions, for example, 
it may be possible to adequately test some configurations by application of 
loads at a single point. The fitting to accommodate these loads could also 
serve as a convenient means of handling the payload, eliminating special 
handling fixtures. 

6. UNTESTED STRUCTURE 

The relationships shown in Figures A-1 through A- 3 show clearly 
the demands which are placed on analytical effort in the absence of a 
structural test. For low factors of safety there is a dependence on ana- 
lytical effort in the absence of a structural test. For low factors of safety 
there is a dependence on analytical and inspection thoroughness and accuracy 
which past test experience has shown to be unacceptable. Several authors 
have studied the error disclosure function of testing from a statistical 
approach and have concluded generally that is is impractical to increase 
safety factors to a level necessary to achieve acceptably low service failures 
without a demonstration of capability. Their results indicate a range in 
required safety factors of from about 4.0 to 11.0 (Ref. A-1) with some authors 
taking the position that only an infinite factor would suffice. Any of these 
values are clearly either impossible or economically infeasible for complete 
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aircraft or aerospace systems of current technology, except possibly in 
special applications which are not constrained by weight. Nevertheless, 
an attempt will still be made to define no-test safety factors for Shuttle- 
launched payloads through an examination of mitigating Shuttle considera- 
tions and attaining contemporary deterministic, rather than 3a, levels of 
performance and safety. 

Re-examination of Figure A-4 suggests that no-test safety factors 
may be determined il all of the uncertainty between predicted strength and 
actual strength is known. This will involve the usual quality control tolerance 
band in addition to analytically based uncertainty, which consists of: 

a. Uncertainty of detailed stresses 

b. Uncertainty of allowable stresses 

c. Numerical error. 

If these cannot be adequately bounded, tests will be required. 

Uncertainty of detailed stress distribution is a function of structural 
configuration, and may be controlled to some extent by the analytical rigor 
applied. Uncertainty associated with allowable stresses is also related to 
structural complexity, depending on knowledge of boundary conditions, 
failure modes, and applicability of available empirical data. This indicates 
that design factor of safety requirements for untested designs should depend 
primarily on the relative complexity of the structural forms and assemblages 
utilized. Recommended safety factors for various test options are given in 
Table A- 1 and reflected in the design criteria in Appendix B. The complexity 
ratings shown are subjective and must ultimately be negotiated v/ith the 
procuring agency responsible for structure qualification. A general guide 
and examples of varying degrees of complexity are given in Appendix C 
for this purpose. The gCt.eral philosophy allows the use of untested structure 
designed to increase safety factors if the structure is simple (amenable to 
conservative analysis) and if adequate analysis is performed. For more 
complex structural forms, higher factors are required together with more 
comprehensive analysis. There are some very complex structure types 
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Table A-1. 


Design Factors of Safety and Test Options 


1 



Yield 

r 

Ultimate 

Qualification- Tested Designs 



Dedicated Test Article^ 

1.00 

1.25 

Flight Sample Test Article^ 

1 « 25 min 

1.25 min 

4 

Acceptance- Tested Designs 

1 • 10 min 

1 . 10 min 

Developnrient- Tested Structural 
Subassembly 



Dedicated Test Article 

1.00 

1.25 

Flight Sample Test Article^ 

1 . 25 min 

1 . 25 min 

Untested Designs or Subassemblies^ 



I Simple Structu--e 

1.5 

2.0 

U 

1.9 

2. 5 

III 

2.3 

3.0 

IV 

2, 7 

3. 5 

V Moderately Complex Structure 

3.0 

4.0 

VI Complex Structure or 
Uncertain Analysis 

Test Required 

Test Required 


NOTES: 

1. All factors presume rigorous quality control (80 percent of ideal) 
Relaxation of quality requires larger safety factors. 

2. Qualification testing implies the flight of at least one untested 
article. Test loads are the same as design loads. 

3. Test loads must be determined from life requirements. 

4. Acceptance testing is performed on each flight article. Test 
loads must be determined from life requirements. 

5. Untested structure requires rigorous conservative stress analysi 
Complexity rating examples are given in Appendix C. 








which will require testing, in which case design safety factors are determined 
from other considerations previously discussed. Simplicity of design thus 
affords cost-saving potential in development, fabrication, and the elimi *ation 
of testing. 

The recommended design safety factors shown in Table A- 1 are 
somewhat arbitrary by necessity. Tested design factors are consistent 
with current DOD practice which, together with the associated surveillance, 
ind analysis requirements imposed on contractors, has produced adequate 
structure. The no-test factors acknowledge that there will be some degree 
of over- estimation of load-Ci rrying capability, even with high analysis 
standards and independent review. It is felt, however, that the factors 
proposed are sufficient to cover these variations if current analysis standards 
are maintained and an objective review procedure established. 

Referring again to Figure A-4, it is seen that with current quality 
control techniques, there will exist an additional allowance for analytical 
variations which range from about 25 percent underprediction for the 
simplest structure to about 55 percent underpredicHon for the most complex 
structure for which analytical qualification is allowed. A quality control 
range of 20 percent also exists. 

A search for compiled static test experience has provtuced only 
one such data set. Failure levels for 450 static tests of military i..irciaft 
wings, fuselages, landing gear, and horizontal and 'vertical stabilizers 
during the 1940*s have been compiled* There were 44 failures below 
ultimate load of which 3 were more than 50 percent understrength. Two 
were 60 percent underst rength, and one was 65 percent understrength. 

The compilation does not separate the contributions of analysis and quality 
control in these failures (Ref. A-2)* 

None of these structures would have experienced service failures 
if designed to the recommended factors shown in Table n-1. Additional 
confidence in the recommended approach is gained by consideration of 
advances in analysis technology since that time and the relatively benign 
loads environment associated with Shuttle missions. 
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The increased importance of analysis for untested structure is 
reflected in the general analysis requirements below* Control of numerical 
errors is best accomplished by an independent review or evaluation of the 
analysis. It should be required that this objective surveillance be performed 
by a government organization or their specified representative. 

7. ANALYSIS REQUIREMENTS FOR UNTESTED DESIGNS 

Structural design is strongly affected by objectives whica cannot 
be absolutely defined or imposed because of performance^ risk, cost, or 
other factors that depend on hazards involved, the mission constraints, or 
details of the vehicle, its structure, and mode of operation. The primary 
objectives addressed here are the requirements for the design of a Space 
Shuttle payload which eliminates or minimizes proof of performance L sting. 
Weight and volume constraints are considered to be of secondary importance* 
However, the payload must safely complete the required number of missions 
in its specified life and accomplish this at minimum cost. The following 
paragraphs present the requirements which must be met in order to achieve 
the design objectives. 

The spacecraft design shall possess sufficient strength, rigidity, 
and other necessary characteristics that are required to survive the critical 
loading conditions that exist within the envelope of mission requirements as 
dictated by all life phases. It shall survive those conditions in a manner 
that does not reduce the probability of the successful completion of the 
mission. The structure shall not be designed to withstand loads, pressures, 
or environments due to malfunctions that would create conditions outside 
the expected mission design envelope. 

Rigor and conservatism shall be exercised in the construction 
and use of mathematical structural models that describe spacecraft 
performance. The models shall be sufficiently comprehensive and 
empirically well founded to assure the accurate prediction of all pertinent 
aspects of structural behavior. 
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In the formulation oi the mathematical model, the magnitude, 
direction, spatial distribution, and time variation of all external limit 
mechanical loads, pressures, and forcing functions shall be determined 
by conservative analyses of the design environments unless provided by 
NASA in the form of enveloping quasi-static loads. In addition, the temp- 
erature distribution throughout the spacecraft and its time dependence 
shall be accurately determined by suitable analyses of the design environ- 
ments. The constitutive relations udiich accurately characterize the relation 
between material stresses, strains, temperature, and time shall be based 
on extensive test data which accounts for the possible influences of 
specimen- to- specimen scatter, material behavior nonlinearities, stiffness 
eccentricity effects, and degrading environmental effects. The mathematical 
model shall properly incorporate the appropriate boundary, juncture, and 
initial conditions. When uncertainty arises, these conditions shall be 
specified in various candidate models so that pertinent aspects of structural 
behavior can be conservatively bounded. The mass distribution, damping 
factors, and other quantities of importance to the dynamic behavior of the 
spacecraft shall be accurately determined and incorporated into the mathe- 
matical model. If large structural displacements appear likely, the 
equations of motion shall include appropriate geometric nonlinearities. 

The analyst shall carefully configure the mathematical models 
to insure that all redundant load paths, cutouts, sources of prestress, 
stress concentration, structural misalignments, and critical dimensional 
tolerances have been accurately accounted for. In addition, sources of 
flexibility /stiffness due to flexible payload interfaces, bearing systems, 
mechanisms, and primary load-path subsystems such as stowed or deployed 
antennas and solar arrays shall be determined by appropriate analyses or 
subsystem development tests and accounted for in the payload mathematical 
models. 

When uncertainty exists in regard to the assumptions made in the 
formulation of spacecraft mathematical models, the extent of the uncertainty 
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should be established by candidate formulations which conservatively bound 
the extent of the uncertainty or by low-cost subsystem development tests. 
Carefully administered general systems engineering/technical direction* 
supported by an independent analysis, is highly recommended for spacecraft 
sytems that are qualified by analysis only. The structural design should 
emphasize simplicity in form and combination of components, assemblies, 
and systems to facilitate accurate determination of load paths and to increase 
confidence in the calculated structural behavior. Construction features, for 
which test data and theory are in substantial agreements, should be utilized 
to the fullest extent possible. 

Values for the allowable mechanical properties of the spacecraft 
structure in its design environment shall be taken from sources approved 
by NASA, such as MIL-HDBK-5B. MIL-HDBK-17. MIL-HDBK-23A, or 
the AFMJLi Advanced Composite Design Guide. When values for mechanical 
properties of materials or joints are not available because they are new or 
used in a new environment, they shall be determined by analytical or test 
methods approved by NASA. A sufficient number of tests shall be performed 
to establish values for the mechanical properties on a statistical basis. The 
tests shall be performed in accordance with procedures in ASTM E8-69t 
E9“70. and AFML-TR-66- 386. **A” values (99 percent nonexceedance with 

95 percent confidence) shall be obtained and used for allowable stresses. 

The effects of temperature, thermal cycling, heating rate, processing 
variables, and detrimental environments shall be accounted for in defining 
allowable mechanical properties. Fatigue-life characteristics of the payload 
structure shall be obtained from references approved by NASA, or by 
experiment, for appropriate cyclical loading and loading rates in the applicable 
environments. Characteristics of the payload structural materials as 
regards failure due to cracking, corrosion, creep, meteoroid impact, 
or irradiation shall be similarly established so that these failure mechanisms 
can be avoided during the service life of the payload. 
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The mathematical model shall yield time histories, as appropriate, 
of pertinent internal displacements, rotations, stresses, strains, loads, 
and moments in terms of the applied loads and temperatures. In addition, 
the model shall predict susceptibility of the payload to general instability 
buckling, panel buckling, and crippling. These theoretical values shall be 
reduced to allowable values by empirically determined conservative knock- 
down factors, as approved by NASA^ vdiich account for the influence of 
characteristic structural imperfections. In this regard, historical buckling 
failure data should be utilized to the fullest possible extent* 

Based upon a conservative evaluation of the internal loads time 
histories, the payload shall be designed to possess adequate strength, stiff- 
ness, and other necessary characteristics to withstand limit loads in the 
expected operating environments throughout its sei/ice life without experi- 
encing detrimental deformation. Similarly, the payload shall be designed to 
withstand ultimate loads in the expected operating environments without 
experiencing collapse or rupture. Design factors shall be applied to limit 
loads but not to the stresses arising from temperature differences and 
gradients. The margin of safety shall be positive and shall be determined 
at allowable ultimate and yield levels and at the temperatures expected for 
all critical conditions. 

8. QUALITY CONTROL REQUIREMENTS 

The control of quality involves the coordinated efforts of many 
scientific and production disciplines and cannot be treated exhaustively 
here. The importance of quality is obvious, not for the attainment of per- 
fection but in the ability to rely on lower-bound quality levels. Through 
considerable experience in aircraft and lightweight aerospace structures, 
quality standards and procedures have evolved vdiich are consistent with 
qualification and acceptance methods. Combined with the traditional design 
factors, acceptable reliability and safety have resulted. 

Continuation of these quality- screening procedures is necessary 
for untested low-cost structure* Acceptance testing is actually a quality- 
limiting process in itself which requires that any contemplated changes 
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in procurement, inspection, or fabrication qxiality control be based solely 
on a willingness to experience more, or less, acceptance test failures. 

This is the case regardless of whether the structure is weight or cost 
optimized. Over-designed structure, however, offers the possibility of 
designing to factors higher than those shown in Table A- 1 for acceptance- 
tested structure so that quality standards may be relaxed without incurring 
higher test failure rates. This type of trade does not affect safety or 
reliability at all; it is a direct trade of quality control cost against structure 
weight and cost and the cost of test failures. 

Qualification- verified designs also allow relaxed quality standards, 
but since quality in this case is an essential safety and reliability determiner, 
it is necessary to establish new standards of control which will essentially 
guarantee lower-bound quality at a new level. This is a task which must be 
carried out as a separate effort, preferably on contractors. 

9. EXPENDABLE PAYLOADS 

The discussion and criteria developed herein apply to all mission 
types. The design of expendable mission payloads will not differ from the 
other three mission types, because the payload may be returned if the 
payload does not satisfactorily pass the on-orbit predeployment checkout. 

10. ON-ORBIT MAINTAINABLE PAYLOADS 

No special considerations are necessary for on-orbit maintainable 
payload missions, since it is a basic premise that structure should be 
designed to include the necessity of on-orbit maintenance. 

1 1 . GROUND- REFURBISHABLE PAYLOADS 

All structure should be designed to the specified number of missions 
and lifetime. Special situations may develop, however, where it may be 
advantageous to design to shorter life and reverify further use by periodic 
acceptance tests. This technique may also be useful in extending the mission 
cycles beyond original design. In any case, the structure should be examined 
for evidence of distress in critical areas and checked for alignment at each 
ground- refurbishment phase. 
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12. SORTIE PAYLOADS 


As with all man-tended missions, it is possible to incorporate 
into the design provisions for real-time vernier alignment of components. 
While this would tend to reduce the required design yield factor of safety, 
it is reconnmended that the criteria in Appendix B be applied uniformly 
to all payload types. 

C. CONCLUSIONS 

It is concluded that the attainment of near-cptimum payload 
structure, considered from a total developm^^nt and production cost stand- 
point, requires that the potential economies of over-designed structure be 
considered. Several possible tradeoffs are identified in this appendix 
between structural weight and the cost- related activities associated with 
development, fabrication, analysis, test, and quality control. When these 
are considered in relation to a specific contractor’s experience, specialty 
field, test facilities, and cost experience, it will be possible to select the 
most promising trades for detailed cost studies. It is also intended that 
some of the approaches discussed in this report, being somewhat uncon- 
ventional, will inspire further re-examination of current traditions and 
expose additional cost- saving ideas. A general conclusion, further re- 
inforced by this study, is that simplicity of design and qualification is the 
single most significant cost reducer in the absence of weight constraints, 
when properly executed. 
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APPENDIX B. LOW-COST SPACECRAFT STRUCTURAL 
DESIGN CRITERIA GUIDELINES 
FOR SHUTTLE- LAUNCHED PAYLOADS^^ 


A* INTRODUCTION 
K SCOPE 

This appendix presents the basic requirements and information 

governing the design of the spacecraft structural subsystem for Space 

Shuttle payloads* Included herein are: 

a. Basic facts and references pertinent to the structural design 

b* Basic objectives for the philosophy of structural design 

c* Conditions and environments for which the vehicle must 
be investigated and designed 

d* Requirements for establishing loads and other 
environmental factors for the design conditions 

e. Requirements and alternatives for establishing 

evidence of structural adequacy 

f* Definition of terms* 

2. AUTHORITY 

This document shall govern the design of the spacecraft structural 
subsystem* Any deviation from these requirements shall be noted along 
with proper justification* 

3. INTENT 

The intent of these criteria is to provide a set of design conditions, 
requirements, and objectives which, when implemented, will insure that 
the structural subsystem achieves acceptable and compatible structural 
integrity. 

This appendix is based on work performed and published in an Aerospace 
Corporation internal report by J. E. Anderson and J. F. Hook, Spacecraft 
Structural Design Criteria Document , ATM- 68(3305) -61 (June 1966). 


B-1 



DEFINITIONS, NOMENCLATURE, AND REFERENCES 
1 . DEFINITIONS 

a. Limit Load 

Limit load is the maximum anticipated load, or critical combina- 
tion of loads* which a structure may be expected to experience during the 
performance of specified missions in specified environments* Since the 
actual loads that are experienced in service are in part random in nature* 
statistical methods for predicting limit loads shall be employed wherever 
appropriate. 

b. Yield Load 

Yield load is obtained by multiplying the limit load by the yield 
factor of safety. 

Ultimate Load 

Ultimate load is obtained my multiplying the lim^^ load by the 
ultimate factor of safety. 

d. Factor of Safety 

The factor of safety is an arbitrary factor meant to account for 
uncertainties and variations from item to item in material properties* 
fabrication quality and details* and internal loads distribution. 

e. Applied Temperatures 

Applied temperatures are maximum calculated temperatures to 
which the structure will be subjected during the performance of specified 
missions in specified environments. 

f. Critical Condition 

A critical condition is a loading or temperature condition which 
dictates the design of a portion of the structure. 
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g. Failure 

A structure is considered to have failed when it can no longer 
perform its intended function. Failure of a structure has occurred when 
a condition exists which may result in the loss of the vehicle, or any part 
thereof, and/or may present a hazard to operating personnel, 

2, REFERENCES/ APPLICABLE DOCUMENTS 

The following documents are applicable to the extent specified 

he rein, 

a. MIL-HDBK 5B, ’’Strength of Metal Aircraft Element” 

b. MIL-HDBK 17, ’’Plastics for Flight Vehicles” 

c. MIL-M-8555A, ”Missiles, Guided: Design and Construction, 
General Specifications for” 

d. Shuttle Environmental Requirements Specification 

e. Shuttle Loads Specification 

f. Meteoroid Environment and Penetration Criterion 

When a conflict occurs between the applicable documents and this 
document, the latter shall govern, 

C. DESIGN CRITERIA 

1. GENERAL DESIGN PHILOSOPHY 

The structure shall possess sufficient strength, rigidity, and other 
necessary characteristics required to survive the critical loading conditions 
that exist within the envelope of mission requirements as dictated by all 
life phases. It shall survive those conditions in a manner that does not 
reduce the probability of a successful completion of the mission. 

Consistent with the structural design principles and assumptions 
listed herein, the structure shall be designed to achieve minimum cost 
wherevei practicable. Proper consideration shall be given to the effect on 
system weight and development schedule. 
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The structure shall be designed by consideration of all critical 
flight and non-flight conditions. Provisions shall be incorporated in the 
design for assembling, handling, transporting, and storing which will 
minimize overall mission costs. 

2. DESIGN CONDITIONS AND ENVIRONMENTS 

The environmental phenomena corresponding to each design condition 
shall include factors that can influence the structural design and typically 
include heating, vibration, shock, and acoustics in addition to qaasi-static 
and dynamic loads. Consideration shall be given to the deterioiating effect 
of prolonged exposure to the space environment. Where possible, all such 
phenomena shall be determined statistically. 

a. External and Internal Load Distribution 

External loads shall be determined by conservative analyses of 
the design environment unless otherwise specified* The internal structural 
load distribution shall be determined by rational analyses. Effects of 
deformations, nonlinearities, and temperatures on internal loads distribu- 
tion shall be included in analyzing the load distributions. 

b. Combined Loads and Internal Pressure 

When internal pressure effects in a combined load condition are 
stabilizing or otherwise beneficial to structural load capability, the minimum 
anticipated internal operating pressure for that condition shall be used instead 
of the ultimate design internal pressure in the ultimate loads analysis. 

Malfunctions 

The structure shall not be designed to withstand loads, pressures, 
or environments due to malfunctions that would create conditions outside 
the expected mission design envelope. For Shuttle mission phases, mal- 
functions shall not result in structural failures that jeopardize Shuttle or 
crew safety. 
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d. 


Misalignment and Dimensional Tolerances 


The expects of allowable structural misalignments^ control mis« 
alignments* and other permissible and expected dimensional tolerances 
shall be considered in the analysis of all loads* lead distributions* and 
structural adequacy. 

e. Dynamic Loads 

Dynamic loads shall be determined for quasi* static and transient 
phenomena expected in each design environment. The calculation of all 
dynamic loads shall include the effects of vehicle structural flexibilities 
and damping and coupling of structural dynamics with the control system 
and the external environment* 

Iterations of the dynamic loads calculations shall be performed 
as necessary to reflect design changes and/or mathematical model refine- 
ments. The final set of dynamic loads shall be determined with the use of 
experimental values of dynamic characteristics as obtained from appro- 
priate tests and modal surveys. 

f. Load and Thermal Fatigue 

The effects of repeated loads and evaluated temperature will be 
considered in the structural design. The design structural adequacy of 
the vehicle in flight shall not be impaired by fatigue damage resulting from 
exposure to non-flight and launch environments. 

g. Vibrational and Acoustical Loadings 

The effects of the vibrational and acoustical environments shall 
be accounted for in design wherever possible by rational analysis of the 
response of the dynamic system to the environment. 

h. Creep Deformation 

The effects of permanent creep deformation shall be considered 
by rational methods of analysis. Where not otherwise critical; i.e.» creep 
buckling, etc., a permanent deformation of one percent shall be considered 
as the maximum permissible value. 
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1 . 


Thermal Stresses 


The effects of thermal stresses shall be combined with the appro- 
priate load stresses when calculating required strength. Thermal stresses 
shall be based on the applied temperatures, heating rates, etc. and shall 
be considered limit values. 

3. MATERIAL PROPERTIES AND ALLOWABLES 

Values for the allowable mechanical properties of the spacecraft 
structure in its design environment shall be taken from sources approved 
by NASA, such as MIL-HDBK-5B, MIL-HDBK-18, MIL-HDBK-23A, or the 
AFML advanced Composite Design Guid^. When values for mechanical 
properties of materials or joints are not available because they are new 
or will be employed in a new environment, they shall be determined by 
analytical or test methods approved by NASA. A sufficient nimiber of tests 
shall be performed to establish values for the mechanical properties on a 
statistical basis. The tests shall be performed in accordance with procedures 
in ASTM-E8-69, E9-70, and AFML-TR-66-386. '*A‘* values (99 percent non- 

exceedance with 95 percent confidence) shall be obtained and used for 
allowable stresses. The effects of temperature, thermal cycling, heating 
rate, processing variaMes, and detrimental environments shall be accounted 
for in defining alio, .able mechanical properties. Fatigue-life characteristics 
of the payload structure shall be obtained from references approved by 
NASA, or by experiment, for appropriate cyclical loading and loading rates 
in the applicable environments. Characteristics of the payload structural 
materials as regards failure due to cracking, corrosion, creep, meteoroid 
impact, or irradiation shall be similarly established so that these failure 
mechanisms can be avoided during the service life of the payload. 

4. STRENGTH REQUIREMENTS 
a. At Yield Load 

The structure shall be designed to have sufficient strength to 
withstand simultaneously the yield loads, applied temperature, and other 
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accompanying environmental phenomena for each design condition without 
experiencing excessive elastic or plastic deforr ation. 

b. At Ultimate Load 

The structure shall be designed to withstand simultaneo jsly the 
ultimate loads, applied temperature, and other accompanying environmental 
phenomena without failure. No factor of safety is applied to any environ- 
mental phenomena except loads. 

c . Margin of Safety 

Margin of safety is defined as: 

MR =4 - 1 

where R is the ratio of applied load (or stress, when applicable) to the 
allowable load (or stress). In determining the factor R, the effects of 
combined loads or stresses (interaction) shall be included. 

5. STIFFNESS REQUIREMENTS 

a. Under Yield Loads 

The structure shall not experience excessive deformations at 
yield loads and in the appropriate design environment. 

b. Under Ultimate Loads 

Structural deformations shall not precipitate structural failure 
during any design conditions and environment at loads less than ultimate 
loads. 

c . Component Stiffness 

The fundamental resonant frequency of any component weighing 
22. 7 kg (50 lb) or less shall be 50 cps or greater when mounted on its 
immediate support structure, unless its structural integrity under dynamic 
loads is demonstrated by analysis or test. 
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6 . 


THERMAL REQU.REMENTS 


The effects of temperature shall be considered in design of the 
vehicle. Thermal analysis shall be based on rational transient analysis 
of heat fluxes from heating, engine exhaust gas radiations, engine system 
and electronic equipment heat sourc''s, and consideration of the heat sink 
effect of the mass of structure, fuel, and equipment. 

Thermal effects on the structure, including heating rates, tempera- 
tures, thermal stresses and deformations, and mechanical and physical 
property changes, will be based on a critical design heating environment. 

7. FACTORS OF SAFETY 


The structural subsystem shall be designed to the following tabulated 
factors of safety, which allow for alternative methods of establishing design 
adequacy. The design verification method selected shall be based on cost 
considerations which satisfy the general design philosophy. 

Complexity ratings for untested design are given as examples 
only. Selected ratings must be supported by a rationale for their se}ection, 
based on analytical confidence for the particular design, and are subject to 
approval by NASA. Structural assemblies with mixed factors of safety 
are acceptable if component parts are developed in accordance with the 
requirement below. Factors higher than /equired are allowed and may be 
necessary to minimize overall deployment cost. 


Qualification- Tested Designs^ 

2 

Dedicated Test Article 

3 

Flight Sample Test Article 

4 

Acceptance-Tested Designs 

Development- Tested Structural 
Subassembly 

Dedicated Test Article 

3 

Flight Sample Test Article 


Yield 


Ultimate 


1.00 

1.25 

1.25 min 

1 . 25 min 

1 . 10 min 

1 . 10 min 

1.00 

1.25 

1 . 25 min 

1.25 min 
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Yield 


Ultimate 


5 

Untested Designs or Subassemblies 



I Simple Structure 

1.5 

2.1 

II 

1.9 

2. 

III 

2. 3 

3.1 

V 

2.7 

3. 

V Moderately Complex Structure 

3.0 

4.( 

VI Complex Structure or 
Uncertain Analysis 


Test Required 

NOTES: 




1. All factors presume rigorous quality control (80 percent if ideal). 
Relaxation of quality requires larger safety factors. 

2. Qualification testing implies the flight of at least one untested 
article. Test loads are the same as design loads. 

3. Test loads must be determined from life requirements. 

4. Acceptance testing is performed on each flight article. Test 
loads must be determined from life requirements. 

5. Untested structure requires rigorous conservative stress analysis. 
Complexity rating examples are given in Appendix C. 

8. DESIGN PHASES 

The payload shall be capable of withstanding design load conditions 
as specified (Ref. B-1) and environments to which it is exposed as specified 
(Ref. B-2) in addition to the orbit phase specified herein. Components shall 
be detiigned for the most severe environmental conditions with consideration 
of both operational and nonope rational states. 

a. Orbit Phase 

The payload shall be designed for geophy leal environments and 
loading conditions associated with orbital flights. The design of the vehicle 
and its parts shall be based on, but not limited to, consideration of the 
following conditions. 
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b. Mane uv'e ring Loads 

Loads resulting from maneuvers for changing orbits, station- 
keeping, attitude control, and rendezvous along critical trajectories using 
actual propulsion, guidance, and control systems shall be determined. 

c . Artifical Gravity 

Where required by the mission, the loads induced by artifically 
simulated gravity shall be determined including the effects of perturbations 
such as docking with other vehicles, movement of equipment, initiation and 
termination of artificial gravity, etc. 

d. Meteoroid Environment 

The payload will encounter a flux of meteoroids as it orbits the 
earth. The structure, pressurized volumes, thermal radiators, solar 
panels, etc. shall be designed to achieve the required probability that 
meteoroid penetrations will not impair their satisfactory functioning. The 
magnitude and characteristics of this flux as well as methods for calculating 
the probability of penetration shall be taken as specified in Reference B-3. 

e. Radiation Environment 

The effect of both natural and artificial radiation environment shall 
be considered in designing the structure, radiators, solar panels, etc. 
including not only the deterioration and induced radiation effects on the 
materials, but also the shielding that may be required for sensitive equip- 
ment. The radiation environment is specified in Reference B-2, 

f . Other Environmental Factors 

Other geophysical environments peculiar to space must be considered 
in the design of the payload. These include the effects of vacuum and 
sputtering due to impinging atoms and ions. Items peculiar to individual 
vehicles such as internal pressurization and the thermal effects due to 
internal heating, solar heating, and extreme cold due to ambient space 
temperature must also be considered. 
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D. REQUIRED ANALYSES 
1. EXTERNAL LOADS ANALYSES 

External loads shall be developed in accordance with procedures and 
for the conditions specified in Reference B-l. Froin these external loads shall 
be developed consistent and conservative combinations of critical loads for 
application in internal loads analyses and instructural tests where required. 

1 . THERMAL ANALYSES 

Thermal analyses for the payload shall be provided which shall 
include correlation of predicted and experimental heat transfer data if 
available. The analyses shall be in sufficient detail to provide transient 
and steady-state externa* surface temperatures and transient and steady- 
state internal temperature distributions for all primary and secondary 
structures as required to determine critical design conditions. The analyses 
shall consider the thermal conductivity of materials and internal radiation 
and convective effects on the heat transfer system. Time-temperature 
distribution plots for all structural components determined to be critical 
shall be presented in graphical form. The analyses shall be in sufficient 
detail that the inboard operating environments may be determined for 
associated internal equipment and secondary structure. 

INTERNAL LOADS AND STRESS ANALYSES 

Internal loads and stress analyses of the structure shall be per- 
formed by appropriate and conservative methods. The analyses shall 
indicate anticipated modes of failure for primary structure and shall 
demonstrate positive margins of safety. Stress analyses shall include 
consideration of fatigue* creep rupture, corrosion, thermal and mechanical 
history, and other detrimental effects that may result from service through 
the several design phases. Thermally induced stresses shall be combined 
with the stresses due to external loads in the stress analyses. 
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The mathematical model shall yield time histories of pertinent 
internal displacements^ rotations, stresses, strains, loacs, and moments 
in terms of the applied loads and temperatures* In addition, the model 
shall predict susceptibility of the payload to general instability buckling, 
panel buckling, and crippling; these theoretical values shall be reduced 
to allowable values by empirically determined conservative knockdown 
factors, as approved by NASA, which account for the influence of character- 
istic structural imperfections* In this regard, historical buckling failure 
data should be utilized to the fullest possible extent* 

Rigor and conservatism shall be exercised in the construction 
and use of mathematical structural models that describe spacecraft per- 
formance. The models shall be sufficiently comprehensive and empirically 
well founded to assure the accurate prediction of all pertinent aspects of 
structural behavior. 

In the formulation of the mathematical model, the magnitude, 
direction, spatial distribution, and time variation of external limit 
mechanical loads, pressures, and forcing functions shall be determined 
by conservative analyses of the design environments* In addition, the 
temperature distribution throughout the spacecraft, and its time dependence, 
shall be accurately determined by suitable analyses of the design environ- 
ments. The constitutive relations which accurately characterize the relation 
between material stresses, strains, tempe rature,and time shall be based on 
extensive test data which accounts for the possible influences of specimen- 
to specimen scatter, material behavior nonlinearities, stiffness eccen- 
tricity effects, and degrading environmental effects. The mathematical 
model shall properly incorporate the appropriate boundary, juncture, and 
initial conditions. When uncertainty arises, these conditions shall be 
specified in various candidate models so that pertinent aspects of structural 
behavior can be conservatively bounded* The mass distribution, damping 
factors, and other quantities of importance to the dynaunic behavior of the 
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spacecraft shall be accurately determined and incorporated into the 
mathematical model If large structural displacements appear likely, 
the equations of motion shall include appropriate geometric nonlinearities. 

The analyst shall carefully configure the mathematical models 
to insure that all redundant load paths, cutouts, sources of prestress, 
stress concentration, structural misalignments, and critical dimensional 
tolerances have been accurately accounted for. In addition, sources of 
flexibility/ stiffness due to flexible payload interfaces, bearing systems, 
mechanisms, and primary load path subsystem^ such as stowed/deployed 
antennas and solar arrays shall be determined by appropriate analyses/ 
subsystem development tests and accounted for in the payload mathematical 
models. 

When uncertainty exists in regard to the assumptions made in the 
formulation of spacecraft mathematical models, the extent of the uncertainty 
should be established by candidate formulations which conservatively bound 
the extent of the uncertainty or by low-cost subsystem development tests. 
Carefully administered general systems engines ring/technical direction, 
supported by an independent analysis, is highly recommended for space- 
craft systems that are qualified by analysis only. The structural design 
should emphasize simplicity in form and combination of components, 
assemblies, and systems to facilitate accurate determination of load paths 
and to increase confidence in the calculated structural behavior. Con- 
struction features, for which test data and theory are in substantial 
agreement, should be utilized to the fullest extent possible. 

4. DYNAMIC ANALYSES 

Intensities of acceleration, shock, vibration, and acoustic noise 
may vary with location in the cargo bay and phase of the mission profile. 

The equipment and structure shall be designed to the critical environmental 
conditions which are established for each particular location. In addition, 
the expected ground handling and transportation conditions shall be taken 
into account. 
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Dynamic loads analyses shall be conducted in cases where rapidly 
applied or fluctuating loads give rise to dynamic response of the vehicle or 
its component parts. Transient loading events of the boost ph^se of flight 
shall be analyzed, if required, with full consideration of the dynamic inter- 
actions of the spacecraft and Shuttle. The interaction of control system 
dynamics and structural dynamics shall be considered. 

5. ANALYSES RELATED TO ORBITAL PERFORMANCE 

In the case of spacecraft for which mission performance is affected 
by structural deformations and dynamic response to mechanical excitation, 
analyses sufficient to identify and evaluate the effects of these phenomena 
shall be performed. Thermal deformations as well as the dynamic response 
to excitation by rotating machinery and other moving parts, rocket motor 
thrust, etc. shall be considered. 

E. REQUIRED TESTS 

1. STATIC TESTS 

a. Development Tests 

Development tests are tests performed to determine and evaluate 
design feasibility, functional parameters, technological data, packaging 
and fabrication techniques, and environmental limitations. This category 
of testing includes tests designed to (1) demonstrate that the design meets 
the specified requirements, (2) identify critical areas where design im- 
provement may be required, (3) identify primary failure modes or critical 
environments, or (4) demonstrate that the probability of passing quu* Ification 
is sufficient high to warrant commitment of equipment to the qualifier. tion 
test. These tests may be conducted to any hardware level and include 
compatibility or integration tests. Development testing required to meet 
program objectives shall be conducted. 

b. Qualification Tests 

Qualification tests are tests performed to demonstrate adequacy 
of the structural design to sustain critical design loads and environmental 
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conditions in the manner required. The structural configuration, materials, 
and manufacturing processes employed in the qualification test specimens 
shall be identical to those of the flight articles. 

When environmental conditions cannot be properly conservatively 
simulated in the test, allowances for material properties, combined loading, 
and other missing effects shall be provided in the test procedu'<*e and loads. 
Where prior landing histories affect the structural adequacy of a test 
article, these shall be included in all test requirements. Adequate instru- 
mentation is required in order to properly evaluate the results of these tests 

The test article shall support 100-percent yield loads with no 
permanent deformation and without experiencing structural member defoima 
tion that will cause interference with other structural members and/or non- 
structural components. The test article shall support 100-percent ultimate 
loads without failure of the primary structure or any other structure that 
may cause failure of the mission. The support fixture to be used in struc- 
tural tejting of all vehicle system sections shall consist of an adequate 
portion of the adjacent struc ural section to provide boundary or support 
conditions >\diLch are identical to i:he support conditions to be realized in 
the flight article. 

c. Acceptance Tests 

Acceptance tests are tests performed on deliverable equipment to 
detect and eliminate articles of substandard manufacture or of defective 
workmanship and to demonstrate, within the scope of the tests, that the 
properties of the equipment are identical within acceptable limits to those 
of the qualification articles. Acceptance testing of structure may be 
waived if product quality can be assured through appropriate quality 
control and inspection procedures. 

2. DYNAMIC TESTS 

a. Ground Vibration Tests 
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Ground vibration tests shall be conducted as neces:?ai'y on the 
spacecraft for the purpose of experimentally determining natural fre- 
quencies, mode shapes, and structural dcunping. The test article should 
be of prime quality structure, complete in every detail with all significant 
installed equipment. Mass simulations of unavailable components may be 
acceptable* 

Spacecraft mounting, or support, fixtures shall provide boundary 
conditions compatible with the conditions being simulated and shall prevent 
significant dynamic interactions of the test article with the support structure. 

It shall be the objective of the mode survey test to thoroughly 
define a complete set of modes in the frequency range of interest (e.g., 

0-50 cps for loads determinations). This will permit the utilization of 
measured modes directly in the desired analysis task, if required. 

b. Fatigue and Acoustical Tests 

Fatigue tests shall be performed as necessary on critical structural 
specimens to demonstrate fatigue life under vibratory loads. Acoustical 
tests of critical structural specimens shall be conducted to demonstrate 
the ability of the vehicle structure to satisfactorily survive the acoustical 
environment. 

3. TESTS RELATED TO ORBITAL PERFORMANCE 

Where dyncunic response characteristics are critical to the 
adequacy of orbital performance, vibration mode surveys of the spacecraft 
system, or subsystems, shall be conducted to verify the validity of the 
analytical model. Similarly, equipments which give rise to disturbances 
on orbit shall be subjected to test to verify the nature and magnitude of 
these effects. 

Where thermal deformations are critical to the adequacy of 
orbital performance, tests to verify analytical predictions of these effects 
shall be conducted. Applied temperatures may be determined by conservative 
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analysis where feasible; otherwise, the structure shall be subjected to 
sources of thermal radiation simulating those to which it will be exposed 
in critical orbit conditions. 

F. REQUIRED DOCUMENTATION 


Documentation of the required analyses and tests specified herein 
shall be prepared and submitted to NASA as contractual items. Analysis 
reports shall contain an adequate description of the data, assumptions, and 
methods used as well as a summary and discussion of significant results. 
Test reports shall contain adequate descriptions of the test setup, instru- 
mentation, and loads or other excitations applied. Raw test data as well 
as reduced data shall be presented. Where appropriate, analyses of 
experimental error shall be included. 
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APPENDIX C. STRUCTURE COMPLEXITY RATING 


This appendix defines and describes the complexity categorization 
used in selecting the design factor of safety. 

A. COMPLEXITY I 

Structural assemblies in this category are typically simple with 
relatively few, well-defined elements* Internal load distributions are 
accurately known by application of static equilibrium principles or simple 
redundant structure techniques. Members are uniform or of regiilarly 
varying cross-section without significant stress concentrations* Failure 
modes are well defined and preclude general or local instabilities, whether 
elastic or inelastic, and fatigue. Allowable stresses and loads are obtained 
from published minimum properties of conventional materials or handbook 
solutions whose application is rigorous. Structural elements in this category 
include uniform compact struts, beams, and thin rings. Axisymmetric 
straight-meridian monocoque shells, shear panels, and plates subject to 
known uniform loads are included. Structural assemblies of these elements, 
when simply and continuously connected, are Complexity I if there are no 
non-linear stress considerations to and including ultimate load. 

B. COMPLEXITY H 

Complexity II structures are those for which the nvimber and 
redundancy of elements requires finite element or continuum analysis for 
internal loads distribution, thereby precluding absolute conservatism at 
every point. Stress concentrations which are small in relation to member 
dimensions and do not produce overlapping stress fields are allowed if 
covered by empirically verified handbook cases. Failure modes of local 
instability with well-defined loads and boundary conditions are allowed if 
based on verified published crippling or panel buckling data. Tension field 
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and fatigue failure modes are not permitted* Ring-stiffened shells, deep 
beams, and ri gs are included in Category II in assemblies which provide 
reasonable certainty of load distribution across element boundaries. 

C. COMPLEXITY III 

Structure in this category includes line- gene rated axisymmetric 
shells with general instability failure modes if amenable to conservative 
specification of boundary conditions and supported by empirically based 
critical buckling data* Post-buckling capabilities are discounted except 
for semi-tension field beams elastically buckled. Stable axisymmetric 
shells subject to concentrated or rapidly varying tangential loads are in- 
cluded if supported by suitably refined finite element analysis. Semi- 
monocoque shells not subject to general instability failure modes are 
similarly included. 

D. COMPLEXITY IV 

Structures of this category require exhaustive computer analysis 
as a result of complex load paths among a large mamber of structural 
elements. Doubly curved, stable, axisymmetric shells are included for 
situations where boundary conditions are continuous and well defined and 
for tangential loads developable in three or fewer harmonics. Fatigue 
failure modes are included only in areas of known uniform stresses in 
conventional materials designed to the lower-bound endurance limit. 

This category also includes semimonocoque shells in instability failure 
modes when suitable finite element models are established which account 
for element-to-element eccentricities, and conservative application of 
appropriate critical buckling data is possible. 

E. COMPLEXITY V 

Structure foims and assemblies in this category are the most 
complex types for which qualification may be established by analysis 
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without test. All previous structure types and corresponding failure modes 
are included, together with the additional complexities introduced by access 
openings, either framed or flanged, and the inclusion of eccentric, disc.rete 
mechanical interface attachments. These added effects are normally 
associated with shell-type primary structure and, although local in nature, 
often are the details which limit overall payload load-carrying capability. 
Assignment of these effects to this category should only be made when the 
construction details and analysis refinement allow the accurate establishment 
of redundant load paths and localized stresses and failure modes. 

F. COMPLEXITY VI 

Structural forms in this category require development, acceptance, 
or qualification test regardless of design safety factor. Configurations, 
complexities, and failure modes not specifically included in Categories I-V 
are relegated to Category VI which includes: 

1. General shells 

2. Fittings, unless consisting of previously described elements 

3. Normal, non-uniform loads on shells 

4. Fatigue failure modes at stress risers 

5. High temperature effects which introduce material non- 
linearities 

6. Geometric non-linearities 

7. Mechanisms and moving mechanical assemblies 

8. Anisotropic materials, except metallic honeycomb. 
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APPENDIX D. FACTOR OF FETY FOR 
PRESSURE VESSELS 


A. INTRODUCTION 

In this appendix, the principles of linear elastic fracture mechanics 
were applied to establish the appropriate factors of safety for design and 
proof tests of pressure vessels for the four types of Shuttle payloads: 
expendable, on-orbit maintainable, ground- refurbishable, and Sortie. 
Aluminum, titanium, and steel were represented among the six common 
alloys selected for this study. A brief description of these alloys and the 
rationale leading to their initial selection are summarized below, and the 
material strengths and fracture toughness are shown in Table D-1. 

1. 2219-T851 ALUMINUM 

The Al-Cu alloy 2219-T851 is re: dily weldable an ^ useful for 
applications at a wide range of temperatures from -452®F (~4°K) to 60U°F 
(^589*^K). It is a relatively tough material, is highly resistant to stress- 
corrosion cranking, and has been used in critical cyrogenic applications 
as well as those requiring high strength and creep resistance at relatively 
high temperatures (400°F - 600°F). 

2. 6061-T651 ALUMINUM 

Alloy 6061-T651 is a readily we'dable Al-Mg-Si alloy possessing 
high resistance to corrosion. It has been used in a wide range of appli- 
cations, including cyrogenic applications requiring high toughness. 

3 . 5 A 1 - 2 . 5Sn TITANIUM 

The all-alpha alloy Ti-5Al-2.5Sn has excellent weldability, 
toughness at low temperatures, and long-term elevated temperature 
strengths. It is not so readily formed into complex shapes as other 
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Table D-1. Material Characteristics 
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alloys with similar room- temperature properties but far surpasses them 
in weldability. Most forming and welding operations must be followed 
by an annealing treatment to relieve residual stresses imposed by the 
prior operation. It is metallurgically stable at moderate elevated tempera* 
tures* The alloy has good oxidation resistance up to lOSO^F (-^840 ^K). 

4. 6A1-4V TITANIUM 

The alloy Ti-6Ai*4V can be used in either the annealed or solution* 
treated-plus aged (ST A) condition and is weldable* Temperature use range 
is from -320^F (~77.6^K) to 750^F (-n* 672^K). For maximum toughness, 
this alloy should be used in the annealed condition, and for maximum 
strength, the STA condition. Stress* relief annealing after welding is 
recommended. This alloy is resistant to oxidation at least to lOOO^F 
(~811®K). 

5. T-1 STEEL 

USS "T*l*' steel is a low carbon, quenched, and tempered con* 
structional alloy steel combining toughness at low temperature, high 
strength at elevated temperatures, ease of fabrication, and excellent 
weld bility. It is a proven engineering material for pressure vessels and 
has superior atmospheric corrosion resistance compared with structural 
carbon steel. It is suitable for many applications involving temperatures 
up to 900^F (-^755^K). This alloy must be used in the heat-treated condi- 
tion, but stress relieving of weldments made of T-1 steel is not generally 
considered necessary because such weldments are tough in the "as- welded" 
condition. However, under certain conditions in which stress corrosion 
is involved, stress relieving may be necessary. T-1 steel may be readily 
cold formed or hot formed provided the hot forming is done at temperatures 
below llOO^F (^866^K) in ord^r to preserve the original mechanical 
properties and toughness. 
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6 . 


HP9Ni«4Co-0.2SC STEEL 


The steel alloy HP9Ni-4Co-0. 25C was developed specifically 
for high hardening and toughness with ease of fabrication. This alloy 
requires quenching and tempering and is readily weldable, even in the 
heat-treated condition, without detrimental effect. Since no preheat or 
postheat are required, welding during refurbishing in the field is possible. 
Fabrication procedures are generally the same as for the familiar SAE 4340 
steel. It is possible to cold form HP9Ni-4Co-0. 25C even after heat treating. 

B. GUIDELINE DEVELOPMENT 

1. ASSUMPTIONS 

Certain assumptions on fracture data were invoked to simplify the 
transformation of this guideline into a practical solution. Foremost of 
these assumptions were the following: 

a. Upper bound flaw growth rate for each alloy is used to 
generate conservative values of proof and design factors 
of safety. 

b. Although the deep flaw magnification factor inc *eases 
from 1.0 to 1.6 as the flaw deepens with additional cycles, 
this factor is taken as a constant value of 1.6 to provide 

a conservative design criterion. 

c. The maximum values of the stress intensity factor are 
limited to the threshold values to minimize the effects 
of sustained loads flaw growth. 

d. The stress level during proof test will be limited to the 
uniaxial yield strength of the material. 

e. The pressure vessel shall be designed to withstand proof 
pressure without yield or excessive deformation and shall 
withstand ultimate pressure without rupture or collapse. 

2. CYCLIC FLAW GROWTH LAW 

The equ'^^ion proposed by Forman, Kearny, and Engle (Ref. D-1) 
relating the rate of crack propagation under cyclic loading to the stress 
intensity factor range 6K is 
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( 1 ) 


da _ C(AK)“ 
dN ■ 

where = crack growth rate, m/cycle; 


AK = K - K . ; 
max min 


= range of stress intensity factor, (MN/m^)i^; 
R = load ratio in a given cycle; 


= K . /K ; 
min max 

= critical stress intensity factor, (MN/m^)ym; 

C 1 coefficients determined emerically to 
n I provide best fit to test data 

By writing this equation in the form 


d(./Q) 

dN ‘ (l-R)Kj^-AKj. 


( 2 ) 


where (a/C^ is the normalized flaw depth, is the critical stress intensity 
factor, and Is tbe range of initial stress intensity factor, Pittit et al 

(Ref. D-2) found that the growth of part through cracks in Inconel 718 at 
cryogenic temperatures was adequately described. Equation (2) was also 
found by Au and Speare (Ref. D-3) to apply to the data trend of Pendelberry 
et al (Ref. D- 4) involving cyclic flaw-growth data for 9Ni4Co (Martensitic 
and Bainitic), 300 M (0.45c and 0. 39c), and D6AC for an air environment 
at room temperature. Accordingly, Equation (2) will be used in this study 
as the appropriate cyclic flaw- growth law for the six selected materials. 

The suitability of this equation is evidenced by an exaunination of Figure D- 1 
for 2219-T851 Aluminum, Figure D-2 for 6A1-4V Titanium, and Figure D-3 
for HP9Ni-4Co-0. 25C Steel. It is seen that the scatter is appreciable. 

The upper bound values of C for each of the six materials are tabulated 
in Table D-1. 


3. EQUATION FOR PROOF FACTORS 

An equation relating proof test factor and the number of cycles 
remaining for a flaw to grow from some initial size the threshold 
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Figure D-2. Cyclic Flaw Growth Data for (A1-4V Titaniiun (Ref. D-6) 
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size was previously derived by Au and Speare (Ref. D- 3) using the 

conventional equations of linear elastic fracture mechanics and Equation 
(2). This equation is 


N 

R(i-TH) 


2a“ 


proof 



(3) 


where N_.. ^-ptn ~ number of cycles remaining for a flaw to grow from 
' some initial size to the threshold size 

Kj^ = plane strain fracture toughness of the material; 

Kth " threshold stress intensity factor; 


a 

proof 

C •' 

C 



= proof test factor; 

= proof test stress level; 

= l.ZlrrM^C; 

= upper bound flaw- growth coefficient; 
= deep flaw magnification factor; 

= 1.60 for this study. 


In Figures D-4, D-5, and D-6, 
cally for several values of K 


Equation (3) is displayed graphi- 
TH^^Ic ^ steel. 


4. PROOF TEST PHILOSOPHY 


Equation (3) can be used with the appropriate proof test require- 
ments to establish the appropriate proof test factors. For single-use 
aerospace pressure vessels, the proof test requirements are well known. 
However, there are no established proof test requirements for reusable 
pressure vessels such as those intended for the Sortie mission and those 
designed for on-orbit maintenance and ground refurbishment. In the 
following paragraphs, several proof test philosophies are advanced for 
consideration along with the proof test requirement for expendable pressure 
vessels. 
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a. Pressure Vessels for Expendable Payloads 

Consistent with established "safe-life" design philosophy, these 
pressure vessels shall be proof-pressure tested before use to demonstrate 
a safe-life of at least four pressure cycles to mean effective operating 
pressure (MEOP). 

b. Pressure Vessels for On-Orbit Maintainable Payloads 

Since the material performance and degradation (if any) in space 
environment for long periods of time are not known at this time, it is 
proposed that allowances be provided to account for this possibility. It 
is also hypothesized that the frequency of retrieval of these pressure 
vessels for maintenance is no more than once every two to three years. 

It follows, therefore, that these pressure vessels are readily demated 
from the payloads such that failure of the vessels during hydrostatic proof 
test will not damage the rest of the payload system. The traditional con- 
cept of safe life design to at least four time *5 the specified service life 
is enforced. 

The above considerations led to the formulation of the proof test 
philosophy that pressure vessels designed for on-orbit maintainable 
payloads shall be proof-pressure tested initially, before the vessels are 
put to service, to demonstrate a safe-life of 20 pressure cycles to MEOP. 
Thereafter, these pressure vessels shall be proof tested to demonstrate 
a safe-life of 16 pressure cycles to MEOP after the first use, 12 pressure 
cycles to MEOP after the second use, and 8 pressure cycles to MEOP 
after the third and subsequent uses. 

c. Pressure Vessels for Ground-Refurbishable Payloads 

Ground- refurbishable payloads involve retrieval of the entire 
payload for ground refurbishment. In this context, two distinct classes 
of pressure vessels must be considered: vessels which can be demated 
from the paylcads and vessels which are integral with the payloads. 
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Consider first dematable pressure vessels. Their proof test re- 
quirements should not differ substantially from those designed for on-orbit 
maintainable payloads. Therefore, foj* this study, these two types of 
pressure vessels are equated as identical. 

On the other hand, vessels that are integral with the payloads 
should not be expected to undergo major refurbishment after each use. 
Indeed, any refurbishment should be limited to normal maintenance and 
resupply function. Clearly, catastrophic failures of integrally designed 
pressure vessels during proof tests are intolerable. However, the possi- 
bilities of failure during proof test always exist from errors in design, 
manufacturing, undetected flaws, etc* The recognition of such possibilities 
therefore requires that these "safe-life" designed pressure vessels also 
be "fail safe. " In this context, fail-safe behavior of a pressure vessel is 
defined as a "leak-before-burst" non-catastrophic failure mode resulting 
from a localized, non-propagating rupture of the vessel v;all. The appro- 
priate proof test philosophy must there ore require that the pressure vessel 
be proof tested initially to demonstrate compliance with expected service 
life, followed by proof test after each use tc verify a safe life of four 
pressure cycles to MEOP. This proof test philosophy is based on the 
argument that successful compliance with the initial proof test will ensure 
that the vessels will meet their service life laquirements if no new flaws 
are introduced during operation, and the subsequent proof tests will ensure 
that no detrimental new flaws are intorduced during the previous use. 

d. Pressure Vessels for Sortie Payloads 

By definition. Sortie payloads return to their launch site at 
frequent intervals. Minimum maintenance and repa -^refore 

important requisites for pres sure vessels designed ^ i purpose. It 
is also surmised that these vessels are exposed to relatively benign en- 
vironments and are housed protectively within the spacecraft. Under 
these circumstances, it appears reasonable to postulate a proof-test 


D-14 



philosophy requiring only an initial proof test before the vessels are put 
to service, to a proof pressure sufficient to demonstrate a sale life of 
four times the specified service life. Obviously, if the assimied conai- 
tions are violated, reproof testing may be necessary and is, in fact, 
recommended to assure operational success* 

5. FACTORS OF SAFETY 

The significance of the proof test on the structural design and 
structural performance of pressure vessels has previously been discussed 
in detail by Tiffany (Ref. D- 8) and also by Au and Spear (Ref. D-3). Briefly, 
if a pressure vessel successfully sustains an elasLic p^oof stress of 


a 


proof 


Of a 


operating 


(cr >1) 


where cr is the proof-test factor, the maximum initial flav/ size which can 

i 2 

exist immediately after the test is 1/cr of the critical size at the operating 
pressure. The vessel will fail if the flaw grows from this initial value to 
the critical value. In addition, a successful proof test indicates that the 
maximum initial-to-critical stress intensity ratio is equal to 1/of, 

Accordingly, a properly designed and successfully executed proof- pressure 
test is perhaps the most reliable nondestructive inspection technique avail- 
able for insuring that there are no initial flaws in the vessel of sufficient 
size to cause failure under operating conditions. 

The appropriate proof factors for the four types of pressure 
vessels can be quantified by suitably combining the aforementioned proof 
test philosophies with Equation (3) and limiting the stress level during 
proof test to the uniaxial yield strength of th material. These proof 
factors are tabulated in Tables D-2 to D-5, inclusively. 

With a knowledge of the proof factors, the design factor of safety 
can be obt' ned simply from the equation 


F.S. 


= Of 



(4) 
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Table D-2. Proof Factors and Design Factors of Safety 
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APPLICATION: Piessure vessels for on-orbit rn'iintaindble payloads and ground- 

rcfurbishable payloads in which tne pressure vessels can be demated 
from the payloads during proof • *sting. 
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Table D-4. Proof Factors and Design Factors of Sa 


PROOF TEST PHILOSOPHY: Proof test initially to demonstrate compliance with 

test after each use to verify a safe life of four prec . 

APPLICATION: Pressure vessels for ground- refurbishable payloads in which the 

with the spacecraft during proof testing. 
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Proof Factors and Design Factors of Safety 


initially to demonstrate compliance with expected service life followed by proof 
each use to verify a safe life of four pressure cycles to MEOP. 

round- refurbishable paylo us in which tho oressure vessels are integral 
ring proof testing. 
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Table D-5, Proof Factors and Design Factors of Safety 
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for all pressure vessel types previously discussed except those pressure 
vessels which are integral with the payloads. For this configuration^ the 
appropriate design factor of safety is the larger of 


F.S. 


u. 

i 



(5) 


or 


F.S, 


I.ZIttM, 



Cp R 
'^meop 


(6) 


Equation (6) defines the minimum factor of safety required for fail safe 
or leak-before-burst behavior at the proof pressure level. Its derivation 
is detailed under **Fail-Safe Design*' below. 

Values of the appropriate design factor cf safety for safe-life 
design of the four types of pressure vessels are summarized in Tables 
D-2 through D-5> inclusively. They are also graphically displayed in 
Figures D-7 to D-10, inclusively. From Figure D-7, it is seen that the 
conventional, although arbitrarily chosen, values of 1.25-1.40 for ex- 
pendable pressure vessels are quire appropriate for this application when 
Kt„/K,c - I.O for single use. 

For fail-safe design of prt ?sure vessels which are integral with 
the payloads during proof testing, the design factors of safety are shown 
graphically in Figures D-11 to D-13, inclusively, for the materials under 
iiwestigation and for = 0.8. Similar design curves can be 

generated for other values of combining the results of 

Table D-4 with Equation (6). 


6 . 


FAIL-SAFE DESIGN: LEAK- BEFORE- BURST CRITERION 


In Reference D-9, an equation defining the minimum factor of 
safety required in fail-safe or leak-before- burst behavior at the operating 
pressure level was derived by 01?en and Speare. This equation is 
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Figure D-7. Design Factors of Safety for Safe- Life Design of 
Expendable Pressure Vessels 
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DESIGN FACTOR OF SAFETY 



Figure D-10. Design Factors of 5>afety for Safe-Life I 
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where 



stress intensity magnification factor, and is a 
function of the flaw depth>to«wall thickness ratio, a/t; 

flaw shape parameter, dimensionless; 

ultimate tensile strength of the material; 

plane strain fracture toughness; 

maximal value of stress coefficients in the 
pressure vessel; 

1/2 for spherical pressure vessels; 
pressure-carrying capability of the vessel; 


R = characteristic vessel radius. 


Corresponding to Equation (7), the upper limit of pressure which 
will result in a fail-safe failure mode is 



Clearly, 



Defining the factor of safety as the ratio of the pressure that 
would cause failure of a vessel to the pressure that acts on it in service, 
it is seen that 



^meop 


Accordingly, (F.S.) ) = (F.S.)pg x ppg 

min max 
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and 


F.S. 


(F.S.) 


(9) 


\ ^meop / 


FS 


nun 


As previously postulated, ground- re furbishable pressure vessels 
which are integral with the payload must not fail during proof testing. In 
other words, the maximum pressure experienced during proof test must 
not exceed the proper limits of that pressure which will result in a fail- 
safe failure mode. Thus, if a is the proof-test factor, the following 
relationship must hold tts fulfill our objective: 


"proof ■ ®Pmeop ^ 


(e > 1) 


( 10 ) 


Equations (9) and (10) can be combined to give 
F.S 


FS 


min 


Accordingly, P^ap^^Pmeop 


(F.S.)pg 


( 11 ) 

(12) 


min 


When Equations (7) and (12) are substituted into Equation (11), 
the appropriate t'xpression for the required factor of safety to insure 
fail-safe operation at the proof pressure level is obtained. Indeed, 

.2 


- ■ 

Ic 


(13) 


When pressure vessels are designed in accordance with Equation (13), 
the critical flaw depth at the proof pressure level should equal the thick- 
ness of the vessel wall. To prove the validity of this statement, we note 
the following relationships: 


®cr ® Pproof 



(14) 



and 


P R 
t - ■ 

' TTf. 

tu 


F*S. X p R 

^meop 

C F, 


tu 

.2 


■m(^) 


for a pressure vessel in the form of a surface of revolution. 
But, p f = « p 


proof *^meop 
l.ZlnM? 


Hence, 


t = 




(15) 


From the familiar hoop stress equation a 
pressure vessel shapes, we obtain 


proof 


p ,R = C to . 
*^proof proof 


= for general 


(16) 


When Equations (15) and (16) are combined and the results simplified, 
we find 


_Q (LJkJ 

I.ZIttM, \ proof / 


= a @ p . (Q. E.D.) 

cr *^proof 

The criteria for the usage of Equation (13) are that 

• If F.S. 2 1t,S . , the potential failure mode is LEAK at 

the proof pressure level. 

• If F.S. < TT57, the potential failure mode is BURST at 

the proof pressure level. 
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C. GUIDELINE APPLICATION 

In the following paragraphs, the design guidelines previously 
developed will be applied to two example problems showing the effect on 
pressure vessel design of operating pressure and single versus multiple 
tank arrangements. 

1. EXAMPLE 1: EFFECT OF OPERATING PRESSURE 

The design requirements are as follows: 

• Ground- refurbishable pressure vessels vdiich are integral 
with the spacecraft during proof testing 

• Uses: 15 

• Operating pressure, p : a. 0.689mn/m^ (100 psi) 

meop 6,895 mn/m^ (1000 psi) 

• Configuration: Spherical pressure vessel with R = 45.7 cm 

( Id in. ) 

• Material: T-1 Steel 

• Environmental Effect: *^<pH^^Ic “ 

The design characteristics are summarized in Table D-6. It is 
seen that for Vessel A, satisfaction of the safe-life requirement auto- 
matically fulfills the fail-safe criterion, whereas, for Vessel B, the 
reverse situation exists. Furthermore, both vessels exhibit the leak- 
before-burst potential failure mode at the initial proof pressures. The 
critical flaw depths for the subsequent proof and operating pressure condi- 
tions are substantially larger than the wall thickness, insuring fail-safe 
failure modes for these conditions should undetected flaws grow to the 
critical size under abnormal circumstances. 

2. EXAMPLE 2; SINGLE TANK VS. MULTIPLE TANKS 

The design requirements are as follows: 

• Ground- refurbishable pressure vessels which are integral 
with the spacecraft during proof testing 
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Table D-6. Design Characteristics for Example I 



VESSEL A 

VESSEL B 

p 

meop 

100 psi 

0. 689 MN/m^ 

1 000 psi 

6.895 MN/m^ 

MATERIAL PROPERTIES**^ 


' 



• 

tu 

129 ksi 

889 MN/m^ 

129 ksi 

889 MN/m^ 

• 

118 ksi 

814 MN/m^ 

118 ksi 

814 MN/m^ 

•*^Ic 

92 ksi y/in. 

... MN r- 
lOl — ^ ym 

m 

92 ksi yinT 

^ MN / — 
101 ^ ^m 

m 

DESIGN CHARACTERISTICS 
• Factors of Safety *^‘ 





- Saie*L.ife 

1. 

84 

(SATISFIED) 

• Fail-Safe 

(SATISFIED) 

3 

.81 

- Proof 





Initial 

1 . 

69 

1 

.69 

Subsequent 

1. 

24 

1 

.24 

• Vessel Thickness 

0.013 in. 

0. 033 cm 

0. 266 in. 

0. 676 cm 

• Surface Density 

0. 00368 psi 

0. 261 g/m^ 

0. 0753 psi 

5.30 g/m^ 

• Vessel Weight 

14. 5 lb. 

6. 54 kg 

306 lb. 

139 kg 

• Critical Flaw Depth^^^ 
- P-oof Pressure 





Initial 

0.063 in. 

0. 160 cm 

0. 266 in. 

0.676 cm 

Subsequent 

0. 114 in. 

0.290 cm 

0.493 in. 

1.25 cm 

■ Operating Pressure 

0. 176 in. 

0. 447 cm 

0, 760 in. 

1 . 93 cm 

a Failure Mode 

LEAK 

LEAK 


NOTES: (1) 
( 2 ) 

(3) 

(4) 


From Table D-1. 

From Table D-4 or Figure D-13. 

Calculated from the equation t = 
Calculated from the equation ^ 


p R X F. S. 
^mcop 

— zK 



with Q = 1 and M. =1.6. 

k 
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• Uses: 15 

2 

• Operating Pressure, Pjj^gQp = 6.985 mn/m (lOCO psi) 

• Configuration; Spherical pressure vessel volume require- 

ment ~ 400, 408 cm^ (24, 4.^0 in. 

• Material: T-1 Steel 

• Environmental Effect; = ®.8 


The Design Characteristics are summarized in Table D-7. It is 
seen that multiple-tank arrangement results in considerable weight savings 
when pressure vessels are designed to internal volume constraints. In 
this context, the total weight for the 10-tank configuration of 66.2 kg (146 lb) 
is substantially less than the single tank weight of 139 kg (306 lb). In all 
cases, the proof-test factors are identical to satisfy safe-life requirements, 
but the design factors of safety differ sharply. For this exajnple problem, 
fail-safe requirements dictate the selection of the appropriate design factors 
of safety for all the multiple-tank arrangements except the 10-tank config- 
uration. All the vessels satisfy the leak-before-burst criterion at the 
initial proof pressure levels and are fail safe against subsequent proof 
and operating pressure conditions. This example further illut/trates that 
for weight-critical pressure vessels which must satisfy safe-life require- 
ments and are required to ensure a fail-safe failure mode, the designer 
should resourt to multiple-tank arrangements whenever possible. 

D. CONCLUSIONS 

From the results of Tables D-2 to D-5, inclusively, and Figures 
D-11 to D-13, inclusively, the values of the proof factors and the design 
factors of safety are seen to be dependent upon the mechanical properties, 
fracture toughness, and flaw-growth rates of the materials, the mission 
requirements, the environmental effects, and the proof-test procedures. 

For expendabl pressure vessels, the design factors of safety for the six 
common alloys range from 1.20 to 1.33 when 1 . 0. These 
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foidout frame 
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Table D-7. Design Char 


PHYSICAL DESCRIPTION 

• Number of Tanks 

• Volume per Tank 

• Radius 

24429 in^ 
18 in 

400, 320 cm^ 
45.7 cm 

2 

12215 in^ 

14. 3 in 

r 

STRESS PARAMETER 




■ 

• P 

18 ksi-in 

3. 15 MN/m 

14. 3 ksi-in 


'^meop 




! 

DESIGN CHARACTERISTICS 




* 

• Factors of Safety =•= 





- Safe-Life 

(SA TISFIED) 

(SATISr 

- Fail-Safe 

3. 

81 

3.0'‘ 

- Proof 





Initial 

1. 

69 

1. ( 

> 

Subseque nt 

1. 

24 

1.; 

1 

• Vessel Thickness 

0. Z66 in 

0. 676 cm 

0.168 in 


• Surface Density 

0, 0753 psi 

5. 30 g/cm^ 

0. 0474 pni 


• Tank Weight 





- Each Tank 

306 lb 

139 kg 

121 .b 


- Total Weight 

306 lb 

139 kg 

242 lb 

1 

• Critical Flaw Depth 





- Proof Pressure 





Initial 

0. 266 in 

0. 676 cm 

0. 1 68 in 


Subsequent 

0.493 in 

1 . 25 cm 

0.311 in 


- Operating Pressure 

0. 760 in 

1 . 93 cm 

0.478 in 


• Failure Mode 

LEAK 

LE., 


■= Obtained from same equations and source as Example 1, Table D-6. 


Table D-7. 


Design Characteristics for Example 2 


320 cm^ 
5.7 cm 

L 

12215 in^ 
14.3 in 

> 

200, 1 60 cm^ 
36. 3 cm 

4886 in^ 
10.5 in 

3 

80064 cm^ 
26.7 cm 

1 

2443 in^ 
8.35 in 

0 

40032 cm^ 
21.2 cm 

■j MN/m 

14. 3 ksi-in 

2. 5 MN/m 

10.5 ksi- in 

1 . 84 MN/m 

8.35 ksi- in 

1.46 MN/m 

‘) 

(SATIS 

7IED) 

(SATISFIED) 

1 . 

84 


3. 0:> 

2. 

22 

(SATISFIED) 


1.69 

1 . 

69 

I . 

69 


1.24 

1 . 

24 

1. 

24 

J cm 

0. 1 68 in 

0. 42 7 cm 

0. 091 in 

0. 231 cm 

0. 060 in 

0. 152 cm 

g/cm^ 

0. 0474 psi 

3. 34 g/cm^ 

0. 0257 psi 

1.81 g/cm^ 

0.0168 psi 

1.18 g/cm^ 


121 lb 

54. 9 kg 

35. 8 lb 

16.2 kg 

14. 6 lb 

6. 62 kfc 


242 lb 

109. 8 kg 

179 lb 

81 kg 

146 lb 

66. 2 kg 

cm 

0 , 1 68 in 

0, 424 c m 

0. 091 in 

0.231 cm 

0. 060 in 

0. 152 cm 

cm 

0. 311 in 

0, 790 cm 

0.169 in 

0. 429 c m 

0.1)3 in 

0.287 cm 

cm 

0.478 in 

1.21 cm 

0.260 in 

0. 660 cm 

0. 175 in 

0. 445 cm 


LEAK 

LEAK 

LEAK 


mple 1 , Table D-6, 

FOLDOUT FRAi\liij 











values are seen to agree with the conventional, although arbitrarily chosen, 
values of 1,25-1.40 for this type of pressure vessels. This agreeme*'t is 
particularly relevant due to the time-tested nature of the convent^o. u 
value s . 

For the other types of Shuttle payloads, the values of design 
factors of safety differ considerably from the conventional values. Tbt:; 
results of this investigation clearly demonstrate the inadequacy of the 
single factor of safety design philosophy practiced conventionally. In fact, 
no single fixed factor of safety is appropriate to ensure safe-life or fail- 
safe behavior for all pressure vessels, nor is the single factor of safety 
design philosophy adequate to address the diversified design possibilities 
offered by the increased capability and versatility of the Space Shuttle 
program. By suitable aoplication of the principles of fracture mechanics, 
candidate materials for specified mission objectives can be ranked on the 
basis of their structural performance, resulting in improved harmony 
among materials, design requirements, and safety of airborne pressure 
vessels. In addition, meaningful design tradeoffs are possible when 
factors of safety are established in a rational manner. 

E. RECOMMENDATIONS 

It is recommended that this guideline be enforced on all pressure 
vessel design for the four types of Shuttle payloads under consideration. 

To further quantify the values for the proof and design Tactors of safety, 
it is also recommended that a detailed material oharacterizaMon program 
be implemented so that specific flaw- growth rates, strengths and fracture 
toughness date, etc. in the expected operating environments can be ascer- 
tained for candidate pressure vessel materials in the appropriate fluid 
environment. 
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APPENDIX E. THERMAL CONTROL 


A, INTRODUCTION 

The basic function of the thermal control subsystem is to pro- 
vide thermal control to the other subsystems v/ithin the payload. With the 
potentially greater payload weight and volume capability available in the 
Shuttle era, the thermal control ubsystem (TCS) should be designed so tho,t 
there are no payload failures caused by loss of thermal control, 

In order to effect this, tradeoff studies should be performed to 
identify the penalties associated with various degrees of cold side bias* 

Cold side bias requires designing the TCS to operate at or near the cold end 
of a subsystem /component's acceptable temperature range. With this type 
of design approach, the res\Ut will be a subsystem# • uponent with better 
reliability characteristics because of its lower operating temperature and 
greater temperature margin on the hot side. The cold side temperature 
margin which is lost by this design approach will be recouped by adding 
heaters. The primary tradeoff involves the additional weight and voltame 
associated with the heater power versus the increase in mean mission 
duration (MMD) and increased confidence in thermal control performance. 

In the modular spacecraft concept, each module should have 
its own autonomous TCS. This will alleviate interface problems such as 
fluid connects and mating of critical heat paths. 

Generally, subsystems /components have different temperature 
limits for operating and non-operating conditions. The use of a cold side bias 
design is directed toward the operating temperature limits. Consideration 
will need to be given to designing the TCS so that subsystem /component 
temperature can be passively controlled when the normal TCS system is in- 
operable. This will provide capability to maintain acceptable temperatures 
during completely quiescent modes. 
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B. ANALYSIS 

1. COST CONSIDERATIONS 

The objective of this appendix is to provide guidelines for the 
production of low cost, reliable payloads launched with the Shuttle. Cost is 
distributed over a large fleet of spacecraft and not charged to just one 
specific vehicle. In order to realistically assess the cost savings potential, 
a cur.iory review of subsystem relative costs was made. Cost information 
was taken from Reference E-^l and is shown in Table E-1 to provide an 
appreciation of the relative costs of spacecraft subsystems. The data are 
for four different representative NASA spacecraft, and both RDT&E and 
recurring costs are shown. 

Experiment costs are not included in this table. Althoi^h the 
percentages for the various subsystems differ among the four missions 
because of differences in orbital and mission objectives, the fact that thermal 
control costs are relaavely small is irrefutable. Therefore, reducing costs 
directly related to thermal requirements will not significantly reduce the 
cost of the spacecraft. Instead, additional uncertainties which may be intro- 
duced into the thermal analysis by reducing the total thermal effort may result 
in increased costs to failures of the vehicle. 

The basic purpose of the thermal control subsystem is to provide 
a support function. It ensures a benign environment in which the other sub- 
systems may function properly. Failure of the thermal control subsystem may 
result not only in loss of the thermal control subsystem proper but also in the 
failure of one or more of the other subsystems. 

2. REVIEW OF SPACECRAFT ANOMALIES 

The extent to which thermal problems currently result in space- 
craft anomalous behavior will have some bearing on the approaches taken for 
a Shuttle payload. If therrual anomalies are shown to be minimal and result 
in minimal impact on spacecraft performance, the thermal design approach 
probably will not differ in the Shuttle era from what is done today. 
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Table E-1. Percentage Costs of Payload Subsystems 
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Failures and anomalies which occurred on selected Air Force 
Programs were reviewed to determine any common underlying causes and 
to determine corrective actions (Ref. E-2). Failures /anomalies were 
classified by discipline, and the results show that of the failure/anomalies 
reviewed, 11.6 percent were attributable to thermal design. Failures/ 
anomalies included overheating caused by surface degradation or contam- 
ination, thermal runaway «.f batteries, and inaccuracies in temperature 
predictions due to analysis and simulation. Although the 11.6 percent 
failures /anomalies did not result in total loss of mission, thermal subsystem 
failures /anomalies did cause a disportionately higher percentage of anomalies 
than its cost would indicate. 

The basic finding of the failure /anomaly review was that a 
si^iificant number of failure /anomalies were due to inadequate thermal design 
resulting from insufficient temperature margins in the TCS design. It must 
be concluded that where system tradeoffs dictate, greater margins should be 
included in the TCS design. Cold side bias with active heaters is a means of 
providing greater temperature margins. 

3. EFFECT OF TEMPERATURE ON FAILURE RATE 

It has been shown that for semi-conductors and microelectronic 
integrated circuits, the Arrhenius model gives a fairly good representation 
of the failure rate (Ref. E-3). The Arrhenius model states that the failure 
rate is exponentially related to the negative of the reciprocal of the absolute 
temperature. Figure E-1 illustrates this relationship. 

Mechanical failures, such as breaking of solder joints and 
seals, are primarily caused by thermal stresses, and occur more readily 
at lower temperatures as shown in Figure E- I . The resultant total failure 
rate also is shown as a dashed line. 
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Figure E«l. Thermal Design 



Another consideration is the effect of temperature variation or 
temperature cycling on failure rate. The effect of temperature cycling is 
not well known in terms of quantitative failure rates, but qualitatively, the 
failure rate increases with increasing temperature cycling. 

Although the quantitative effect of temperature on failure rate 
is not well defined because of the individual characteristics of each component 
and despite the dearth of available data oi this type, several general con- 
clusions can be drawn regarding the effect of temperature on failure rate: 

a. Failure rate will increase with both too low and 
with too high an operating temperature. 

b. There is generally a minimum in the temperature- 
failure rate curve. 

c. Temperature cycling tends increase failure rate. 

Thermally, the message is that in order to reduce temperature- 

induced failure rates, components should be run at a relatively constant 
temperature. The temperature level at which a specific component operates 
optimally (from failure rate considerations) is characteristic of each specific 
component. Typically, however, optimal temperatures are near the lower end 
of the currently utilized temperature ranges. Although documented data is 
meager supporting the fact that the lower end of the temperature range is 
near opt? lal, data on NiCd batteries was found which supports this con- 
tention, (Ref. E-4). 

4. COLD SIDE BIAS 

Common practice is to design the thermal control subsystem so 
that there are equal margins on both the hot and cold sides. The rationale 
is that it is. equally difficult to predict hot or cold temperatures, and a 
compon at is therefore equally likely to fail as a result of either a too cold 
or a too hot environment. 
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Cold side bias is a concept wherein a component is designed 
thermally to operate relatively near its cold temperature limit. The result 
is that additional temperature margin is gained on the hot side with loss of 
temperature margins on the cold side. Heaters are then used to provide the 
necessary cold side margin. 

The cold side bias concept is illustrated in Figure E-2 which 
shows internal heat flux as a function of temperature for both the maximum 
and minimum environmental conditions for a typical geosynchronous orbit. 

A typical electronic equipment operating range is also shown in Figure E-2. 

When operating in the cold bias mode, the nominal temperature 
of the equipment is reduced, and the temperature margin on the hot side is 
increased. These advantages are not free; the penalty to provide these 
characteristics is additional heater power. The amount of additional power 
required is dependent on the orbital conditions and the amount of heater 
margin one wants to incorporate into the design. The additional power 
requirement will probably be acceptable because of the large weight and 
volume capability of the Space Shuttle. 

Figures E-3 through £>5 show radiator heat rejection capability 
as a function of temperature for various orbits. The minimum and maximum 
environments refer to the minimum and maximum orbital heatii^ conditions. 
For example, for a radiator with a constant internal load, its temperature 
will cycle (horizontally) between the minimum and maximum environments. 
Thermal extremes are greatest in the synchronous orbit and smallest for 
the low earth orbit radiator facing the earth. 

5. EFFECT OF COLD SIDE BIAS DESIGN ON SURFACE PROPERTY 

CONSIDERATIONS 

Past experience has shown that thermal surface property 
degradation results in substandard thermal performaince of certain space- 
craft. The primary causes for performance degradation have been UV 
radiation damage and surface contamination. The result of these types of 
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Figure E-5. Cold Plate Heat Rejection Versus Temperature 




damages is primarily an increase in surface absorptivity. One spacecraft 
using second surface mirrors is showing an oc degradation of approximately 
two percent per month, and similar degradation data has been shown for 
white paints (Ref. E-5). Consequently temperatures increase. 

The use of the cold side bias concept for common spacecraft 
equipment results in increased temperature margins on the hot side. If the 
causes of solar absorptivity increase cannot be alleviated by design or 
material control consideration, nominal temperatures can be expected to 
increase. However, the cold side bias concept increases the available hot 
side temperature margin so that the time to reach the maximum permissible 
temperature, and therefore vehicle life, is increased. 

6. PASSIVE THERMAL CONTROL IN THE NON-OPERATIONAL MODE 

The use of a cold side bias design will result in a relatively 
constant temperature component design at a relatively low temperature. The 
use of a cold side bias design concept, however, will have limitations due to 
several considerations. First, the orbital considerations and the tradeoff 
between the benefits of cold side bias and heater power must be considered. 
Second, the problem of a module or subsystem getting too cold in a failed 
mode must be considered. 

In present expendable satellite design, no consideration is 
given to the design requirements for a salvageable satellite in the event of 
a failure. When one speaks of refurbishing a satellite, one must consider 
maintaining the failed satellite in a refurbishable condition. Additionally, 
in the event of a failure, the design must effectively isolate the failure so 
that secondary failures will not result. In the area of thermal control, the 
primary cause of secondary failures is components becoming excessively 
cold after a power failure. A power failure may result in both the loss of 
internally generated heat and heater power capability. Subsequently, the 
component may be permanently damaged by the excessive cold. In order 
to avoid this problem, the use of the cold side bias design must be tempered 
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with the constraint that the TCS should be required to prevent connponent 
temperature in a zero-powered condition from falling lower than the component 
specified minimum non-operating temperature. 

7. APPUCABIUTY TO PAYLOADS 

The philosophy of improving TCS performance to provide 
better payload temperature control is applicable to expendable, on-orbit 
maintainable, and grotind refurbishable payloads. The extent to which cold 
side bias can be applied is dependent on the weight and power penalties 
involved. The acceptability of these penalties is rather a function of the 
orbit than the type of mission. Orbital parameters are important, because 
they define the space environmental condition and also determine the payload 
allowable total weight. 

C. CONCLUSIONS 

In determining thermal guidelines for spacecraft design in Uie 
Shuttle era, several initial considerations were investigated. First, since 
the ultimate objective is to provide guidelines for a low cost payload, space- 
craft subsystem relative costs (excluding experiment costs) were reviewed. 
Second, spacecraft experienced failures and anomalies were reviewed to 
determine the extent to vhich thermal problems have contributed to failures/ 
anomalies in the past. Third, the effect of temperature on failure rate was 
evaluated. Finally, a thermal guideline was developed which is believed will 
resxilt in a more reliable and cheaper vehicle. 

A review of spacecraft system cost data revealed that thermal 
subsystems were one of the least expensive subsystems. Thermal control 
amounted to less than five percent in each of four typical NASA spacecraft 
missions reviewed. Consequently, a significant cost savings will not be 
effected by reducing TCS related costs. Even if TCS related costs can be 
totally eliminated, total cost will not be reduced appreciably. Consideration 
of spacecraft experienced failures and anomalies seems to indicate that in 
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the Shuttle era, more effort (both analytical and experimental) should be 
expended in the area of thermal control, because the results of failures/ 
anomalies attributable to thermal design may result in losses far greater 
in cost than the actual cost of the TCS» 

It would appear that the thermal design approach to use in the 
Shuttle era would be to incorporate an improved TCS to increase performance 
and reliability. The primary obstacles to improved thermal design 
traditionally have been constraints on vehicle weight and volume. Weight 
limitations are reflected primarily in constraints on available power for 
thermal control. With the Shuttle, it is anticipated that we" nd volume 
constraints will be relaxed to result in a better spacecraft 

Reliability and failure rate data indicate that te.. ^«^rature has 
an impact on MMD considerations. First order considerations indicate that 
electronics failure rates can be approximated by Arrhenius* Law, which 
states that failure rate is exponentially related to the reciprocal of the 
absolute temperature. Consequently, it appears that from a component/ 
subsystem reliability standpoint, it will be advantageous to operate the 
component at a reasonably low temperature. However, the iov^er temperature 
limit will be limited by mechanical-failure -rate considerations. Additionally, 
the implication is that it is advantageous to operate components at a 
relatively constant temperature. 

A basic conclusion which was deduced from the above review was 
that trying to reduce thermal cost will not significantly reduce program cost. 
Additionally, since thermal control is ? relatively low cost item, the 
additional weight and volume available for Shuttle payloads should be used 
to provide a better performing TCS which should result in a better performing 
spacecraft. 

These conclusions and reliabilUy data resulted in the proposed 
application of the cold side bias concept in which components are operated 
near the cold end of their thermal operating range. In order to do this, 
heater power is required. 
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D. RECOMMENDATIONS 

It is recommended that in the design of Shuttle p» 'ads, the 
additional weight and volume capability of the Shuttle be utili-. a in part to 
provide more stringent temperature control in order to incre?*.jo subsystem/ 
component performance characteristics. Alth*->ugh this may result in a 
heavier anJ perhaps more expensive thermal cont. '1 subsystem, it is 
believed that on an overall systems basis, it will result in a cheaper vehicle 
because of improved per rmance, life, and reliability. 

The degree to which better temperature control car be effected 
will depend on the penalties involved (weight, power, voliame). Consequently, 
it is c ’so recommended that improved methods of temperature control be 
'valuated on an individual payload basis because of the differences in the 
importcuice of tradeoff parameters for each payload. 

It is further recommended that cold side bias be considered as 
a means of providing improved thermal control. 
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APPENDIX F. REACTION CONTROL 


A. INTRODUCTION 

The development and fabrication of high- efficiency, reliable 
reaction control subsystems for conventional satellites has been 
(historically) very costly. This situation is the result of the limited 
lau '.ch weight capacity of expendable boosters which imposes stringent 
weight limits on the satellite, high reliability demands, and highly pre- 
cise impulse bits required by the satellite control subsystem. It is 
apparent that the unique capabilities of the Space Shuttle (excess launch- 
weight capacity, orbit rendezvous, and retrieval) may be utilized to 
substantially reduce these costs while maintaining the required satellite 
operational reliability. 

B. ASSUMPTIONS 

The reaction control subsystem provides thrust for such 
functions as attitude control, stationkeeping, spin-up, despin, on-orbit 
maneuvering, spin-axis precession, and apsis corrections. This analysis 
specifically excludes the orbit injection maneuver which requires its own 
unique tradeoff study comparing the use of the Shuttle/Tug, an expendable 
kick stage, or an additional propulsion subsystem within the payload. 

Table F -1 lists some of the types of propulsion subsystems 
available for consideration in payload design. For this analysis, it is 
assumed sufficient to analyze only the three most common types, which 
are inert gas, hydrazine monopropellant, and the N20^/MMH bipropellant. 



Table F-l. Types of Propulsion Systems Considered 


Inert Gas 

Freon 

* Nitrogen 
Helium 
Argon 
Ammonia 

Mixed Gases 

Tridyne (O2 + H2 + N2) 

Freon - Nitrogen 
Helium - Nitrogen 

Liquid Monopropellant 

♦ Hydrazine 
Peroxide 

Subliming Solid 

Solid Propellant 

Liquid Bipropellant 


Heated Gas 

Electrical (1^2' ^^3* 
Radioisotope (Hg, 
Nuclear Reactor (H2 

Ionic 

Cesium 

Pulsed Plasma 

Teflon 

Mercury 

Colloid 

Glycerol 


♦ Storables (N20^/MMH» IRFNA/UDMH, etc.) 
Cryogenics (F2/H2, O2/H2, etc.) 


Electrolysis 

Hydrazine 

Water 

Peroxide 


* Most commonly used for satellites 


etc. ) 

, NH3) 


F -2 



In order to reduce study examples to manageable numbers 
of variables, it is assumed that the payload requires 12 thrusters in 
the 89-N (20-lb) or less thrust range. Assuming specific impulses 
of 65 sec, 200 sec, and 300 sec for nitrogen, hydrazine monopropellant, 
and bipropellant, respectively, the propulsion subsystem weight, cost 
and volume were determined and are presented graphically in Figures 
F-1 through F-3. These results are useful for comparative purposes 
during preliminary design and as an example of the approach to an 
appropriate system tradeoff analysis. 

C. ANALYSIS 

The approach to selection of the most cost-effective propulsion 
subsystem is keyed to the payload type. An expendable payload with a 
long life may require a much more sophisticated system than an on-orbit 
maintainable or ground- refurbishable payload in order to meet the weight 
and reliability requirements. However, the first consideration should 
be a pressure-regulated nitrogen gas subsystem. It is the simplest and 
least costly of any of the subsystems for total impulse requirements less 

4 

than approximately 6.7 x 10 newton sec (15,000 lb sec). As requirements 
exc(*ed this value, the inert gas subsystem becomes too costly, primarily 
due to the large volume, high pressure tankage required. Comparative 
weights of die three systems versus total impulse requirements are 
given in Figure F-1, and the rapid increase in weight with total impulse 
requirements of the nitrogen subsystem is apparent here. For a total 

4 

impulse delivered of 6. 7 x 10 newton sec (15,000 lb sec), the inert gas 
subsystem is four times as heavy as the other two subsystems, and the 
tank -/olume is an order of magnitude greater than that for the liquid 
subsystems (Figure F-3). An assumption of "no redundancy" was made 
in the data provided in Figures F-1 through F-3. The data do not 
include cost or weight of any positive expulsion device. Because cost 
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Figure F-2. Recurring Procurement Coits as a Function of 
Total Impulse and Propellant Type 





Volvime (Propellant Plus Pressurant Tankage) 
Function of Total Impulse and Propellant Type 






is the prime consideration, the nitrogen gas subsystem should be given 
first choice if the weight and volume are not incompatible with system 
requirements. 

If the nitrogen subsystem is not feasible (because of high 
total impulse requirements or excessive weight), the next consideration 
should be the hydrazine monopropellant subsystem. A typical ^ 2^4 
subsystem would operate in the blowdown mode (no regulator) with the 
propellant tank filled with hydrazine and pressurant in approximately 
equal voltimes. Such a subsystem actually has fewer components than 
an inert gas system and may have equivalent or higher reliability is 
will depend on the mission duration/ refurbishment cycle in which the 
expected failure rate of mono-propellant thrusters is traded against the 
failure rate of a regulator. 

The hydrazine subsystem shows a cost advantage over a 

bipropellant subsystem for total impulse requirements less than 13.3 x 
5 

10 newton sec (300,000 lb sec). At this point, the greater volume and 
weight of the hydrazine propellant required demand large costly tank 
volumes. Also, in this region it becomes necessary to consider a 
pressure-regulated subsystem to reduce system volume by storing the 
pressurant in smaller high pressure tanks, thereby adding complexity 
and grading reliability. 

If neither of the discussed subsystems can meet the total 
impulse requirements within the weight and volume constraints, the 
liquid bipropellant subsystem remains as the only choice. Here the 
tradeoff is between the reduced weight and volume of a bipropellant 
subsystem against its increased complexity and hazard and reduced 
reliability. 

A mention should be made of a combined mono/bipropellant 
subsystem using N20^/N2H^ propellants. In this concept, hydrazine 
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can be used to power small attitude control thrusters which operate 
mostly in a pulsing mode, while the bipropellant with high specific 
impulse can be used for any larger engines expending a greater amount 
of total impulse. 

For the liquid propellant subsystems, operation under zero g 
environment will be a requirement. To meet this requirement, bladders 
or surface-tension devices will be employed. Bladders may be either 
organic materials or metals. The selection will be made on the basis 
of material compatibility with the fluids used and the number of expulsion 
cycles and temperatures to which they are subjected. In general, 
nonmetallic bladders are suitable for multi- expulsion cycle application 
while metallic ones are limited usually to one or two expulsions (exceptions 
to these are the metal bellows). Surface-tension devices have been 
successfully employed with large tanks on the tank's outlet to trap enough 
liquid to allow the start of a rocket engine (as on the Agena). They have 
also been e3q>erimentally demonstrated in smaller tanks but have not 
been used in the numbers that bladders have. Care must be exercised 
in the design of surface-tension devices to ensure that heat soakback 
does not vaporize the propellant downstream of the surface-tension screen 
creating a AP that forces the trapped liquid back through the screen 
during a coast period, leaving only gas between the screen and the rocket 
engine inlet. 

For some specialized applications, the water electrolysis 
propulsion subsystem could be considered. This subsystem is applicable 
to extended- duration missions that do not require large intermittent 
expenditures of propellant which would require prohibitively large 
electrical power and/or gaseous (hydrogen and oxygen) storage. This 
type of propellant generation (the evolution of hydrogen and oxygen from 
water by electrolysis) has been demonstrated but has not been developed 
to the point of flight-qualified hardware. The inherent advantages of the 
system are high 1^^ (combustion of H 2 and O^)* storage of the propellant 
as water (compact) ^ very low hazard, no toxicity, etc. 
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The propulsion subsystem components can be divided into 
three categories with respect to their expected reliability. These 
components are grouped in Table F-2. The Category 1 components 
are low reliability and have a useful life limit expressed in number of 
cycles. The low reliability of propellant tanks is due to the corrosion 
hazard of liquid propellants. Increased safety margins for such tanks 
will be an important factor in improving their reliability. The components 
in Category II are of medium reliability, are. in general, not subject to 
mission time limitation, and could be reused in a refurbishment cycle 
after a suitable checkout test. The components in Category III have 
essentially unlimited life. It is possible to bring the high-pressure 
vessels into that category if the safety factors are suitably increased. 

The costs shown are typical for small number production components 
and do not reflect the cost reduction which could be realized with larger 
production batches and modified specifications. 

A detailed discussion of the properties of the three types of 
interest is presented in the following paragraphs along with the rationale 
for the RCS design approach for each type. 

1. EXPENDABLE 

The selection of a propulsion subsystem for an expendable 
payload is mainly mission dependent. The impulse requirements, the 
life on orbit, reaction force levels, etc. are determined by the mission, 
satellite mass properties, and attitude control method employed. The 
propulsion selection then is made to provide the reaction control 
subsystem that will meet the required mission reliability with minimum 
cost. 

The tradeoff of weight, cost, and volume for the reaction 
control subsystems that will meet the technical requirements of the 
mission must be made (as illustrated in Figures F-1 through F-3). The 
selection will then be self evident. In determining projected reliability 
levels, the factors listed in Table F-2 may be used as a guide. 
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Table F-2. Typical RCS Component Characteristics 



■typical 

typical 

Typical 


Cycle 

Production 

Reliability 

Component 

Life 

Cost ($) 

Factor 

Category 1 



10 "^/hr 

Propellant Tanks 

50 

8, 000 - 3 

16, 000 /ft 

330 

Thrusters, N 2 H^ 

100,000 

4, 000 each 

166 

Thrusters, 

50,000 

8, 000 each 

400 

N 20 ^/hdMH 




Thruster Valves 

200,000 

4.000 each 

347 

GNj 

Thruster Valves, 

100,000 

4, 000 each 

347 

N 2 H 4 




Thruster Valves, 

50,000 

4,000 each 

347 

N 2 H^/iMMH (2 req'd) 




Pressure Transducers 

100,000 

500 each 

340 

Pneumatic Regulators 

100.000 

5, 000 each 

245 

Check Valves 

100,000 

500 each 

250 

Positive Expulsion 



300 

Bladders 




Category 11 

i 



Nitrogen Tank 

50 

4, 000 - - 
5,000/fr 

14 

Thrusters, GN 2 

200,000 

500 each j 

17 

Fill and Drain Valves 

50 

500 each 

70 

Thermistors 


500 each 

25 

Category ill 




Pyro Valves 

1 

500 each 

— 

Filters 

1 

500 each 

1-10 

Piping Sc Brazed Joints 

— 

— 

1-10 

Brackets, Structural 

... 

— 

1 

Components 





F-10 










In principle, the expendable payloads do not i equire propulsion 
modularization since no refurbishment is possible, although in pre-orbital 
checkout in the Shuttle, a replacement of a module, if found defective, 
could enhance the overall mission success. 

However, if the principle of standardization of certain 
subsystems, including propulsion, is developed because of the on-orbit 
or on-ground refurbishable payloads, it may be economically attractive 
to use similar standard housekeeping modules in expendable payloads. 

The question of redundancy of propulsion components for 
expendable payloads should be resolved by consideration of component 
reliability, such as shown in Table F-2, against the desired mission 
time and reliability goals. 

A number of options are open to the designer to achieve 
minimum cost at the required system reliability level. If the total 
impulse requirements are low, a totally redundant nitrogen gas subsystem 
might be less expensive and more reliable than a single hydrazine sub- 
system. Lower reliability components within a single hydrazine subsystem 
may be made redundant to improve its reliability. There may be, indeed, 
a great need for redundancy in this type of payload as opposed to the 
refurbishable type, particularly for long duration missions. 

Consideration must be given to the Shuttle interface require- 
ments for crew safety, propellant dump requirements (in case of an 
abort), environment, etc. , and this is equally applicable to all of the 
other payloads. 

2. ON-ORBIT MAINTAINABLE 

The concept of maintaining a satellite on orbit as compared 
to the expendable concept may profoundly influence the design of the 
propulsion subsystem and the choice of ptopellants, since the choice 
of a subsystem based solely on the total impulse requirements may no 
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longer be valid. As an example, consider the long-life expendable 
satellite with large total impulse requirements that normally would 
force the choice of a bipropellant liquid subsystem to meet the weight 
and impulse limitations. If the same satellite may be visited some 
number of times during its life on orbit, a simple nitrogen gas subsystem 
that is resupplied at intervals may meet the system requirements at 
significantly lower cost and with higher reliability. Obviously, if the 
resupply missions should be flown exclusively to resupply the propellant, 
the cost of the resupply mission must be included in the tradeoff study 
and might negate the lower cost of the inert gas subsystem. It is 
assumed, however, that programmed on-orbit maintenance will be for 
the benefit of many systems and that the propulsion subsystem will Le 
planned to use this available maintenance to best advantage. 

The planning of the quantity of propellant and type, then, 
is to meet the impulse requirements between resupply visits. Another 
fundamental decision faces the designer at this point. Having selected 
the propellant, shall the resupply vehicle refill the original tanks on the 
satellite, replace tank modules with fully charged tank modules, or 
perhaps replace the complete propulsion subsystem modules which will 
contain a block of thrusters, tanks, and appropriate valving? The 
primary advantage for the last approach is that it eliminates propellant 
and pressurant interfaces (and potential leaks) and reduces interfaces 
to a single electrical connection for propulsion control. The disadvantage 
of this approach would be in the duplication of tanks, regulators, valves, 
etc. , since two or more modules will be contained in a payload which 
increases the weight and cost. Also, such modules must be designed 
to carry the maximum pronellant that is required for any situation (no 
propellant crossfeed capability), thus adding weight. Each module would 
be identical in order to minimize cost. 


F-12 



Another alternative is to replace an empty ♦■ank with a full 
tank but not replace thrusters, valves, regulators, etc. This requires 
a quick- disconnect-type fluid connection whicn has a leak potential. In 
the event this approach is chosen for the refillable tank, redundancy in 
some critical components, such as dual- seat disconnects and latching 
solenoid valves, may be desirable to provide the reliability for the 
system that is specified. For the requirement of zero g expulsion with 
liquid propellants, this approach may be considered superior to the 
alternative discussed below, because it provides for an automatic 
replacement of a positive expulsion device which may be cycle linruted. 

On-orbit refueling with no routine hardware replacement 
is a third option that has a number of advantages. The most obvious 
one is the cost savings, not only in reduced hardware requirements but 
also in making no demands on the satellite design to facilitate exchanging 
modules to satisfy the total impulse requirement. In its simplest 
concept, only a quick disconnect would be required to refuel the tank. 

This would be the least costly and lightest of the above concepts for a 
given propellant. The disadvantages are possible leakage at the disconnect 
and multiple-cycle demands on an expulsion device. 

Finally, there is the situation where, either because of 
design constraints, refueling-in-orbit hazards, or the high cost of 
complete multi-propulsion modules, large enough tanks will be provided 
to contain all the fluids required for the mission. In such a case, the 
choice of the propulsion subsystem will be based on the previously 
discussed total impulse criteria. However, even in this case, the 
problem of flu'd disconnects will face the designer. 

In the modularization of propulsion subsystems, two principles 
will be involved; one is to include in a module all of the low reliability 
components (Category I) which may need refurbishment, and the second 
is to provide isolalicn valves so that a malfunctioning module could be 
isolated and the remaining modules carry on the attitude control functions 
into the next refurbishment cycle. 
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The FleetSatCom reaction control subsystem offers an 
excellent example of modularization, it is relatively complex, and it 
incorporates most of the features and component types that are used on 
satellite payloads. Figure F-4 is a block diagram of the present 
FleetSatCom reaction control subsystem. The blocks are arranged in 
the form of a system schematic such that the propellant flow path from 
the propellant tanks to the thruster nozzles can be easily traced. The 
system incorporates protection against likely single-point failure modes 
by the use of standby redundant thruster systems. 

Figure F-5 illustrates (in block-diagram form) the application 
of modularity to the FleetSatCom type of reaction control propulsion 
subsystem. The entire Figure F-5 system would be a complete, self- 
contained propulsion module. The modules would be strategically 
located on the spacecraft to provide the required reaction control forces. 
Redundancy requirements would be met by simply adding additional 
standby modules. This approach has th„ advantage of ease of maintenance, 
since a complete system can be removed and replaced as a unit. The 
general approach also leads to the possibility of standardized propulsion 
system modules that may be used on a numb rent payloat’a. 

This idealized approach could only be considered for Space 
Shuttle launches, since there are very large penalties to be paid in 
weight, volume, mass properties, and performance. Also, the block 
diagram has been simplified so that it does not include instrumentation, 
heaters, electrical control to valves, test ports, and structural 
interfaces. 

Figure F-5 also illustrates a lower level of subsystem 
modularity. For instance, the use of interchangeable thruster modules 
has been demonstrated to be practical on several programs and should 
be emphasized as a standardization objective for the S.iuttle era. Further 
modularization of other subsystem elements such as tankage and the gas 
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Figure F-4. Block Diagraitn of a Typical Satellite Propulsion 
Subsystem (FleetSatCom) 
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l^igure F-5. Block Diagram <>f Modularized Propulsion 
System (FleetSatCom) 
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generator -plenum subsystem leads to a building- block approach which 
could provide cost savings through standardization. This approach is 
currently employed to a certain extent on Air Force programs, as each 
new program tries to make maximum use of previously qualified and 
flown hardware. This building- block approach of assembling standardized 
subsystem and subassembly modules into a propulsion system is generally 
the most effective approach, but it necessitates breaking propellant feed 
system attachments for module replacements. 

If the propulsion subsystem has. for instance, a pressure 
regulator, the designer's option is to either include it in one of the 
replaceable modules or to provide a redundant regulator(s). 

The question of redundancy in the attitude control subsystem 
has to be carefully considered because the docking maneuver will, in 
general, require an attitude- stabilized payload. A single failure or even 
a dual failure mode has to be considered either by module redundancy 
or by a backup cold gas system. 

The problem of fluid disconnects was mentioned before. 
Drip-free fluid disconnects are at present available and a redundant 
seat arrangement, perhaps combined with an isolation valve actuated 
before a disconnect operation, could possible ensure hazard- and leak- 
free operation. Similar attention shotild be paid to electrical connectors 
which will probably lead to a departure from the standard multi-pin 
concept. 

To take full advantage of the Shuttle era. consideration 
should be given to standardization of propulsion modules into two or 
perhaps three thrust levels to suit the variety of payloads anticipated 
by NASA with a resulting reduction in RDTScE and production costs. 

Considering the refurbishment potential, the designer should 
weigh the possibility of relaxing some of the specifications for components 
such as thrusters (number of cycles), valve leakage criteria, and higher 
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safety factors which would reduce the cost of production and testing of 
the components. Similarly, the possibility of pre-fueled fluid tanks 
hermetically sealed should be considered which would eliminate prelaunch 
testing of the thrusters. Such a procedure is adopted at present in an 
ICBM system, and the bipropellant thrusters are only sample tested at 
the factory. 

An important factor for the in-orbit replacement is the need 
for telemetry signals either to the Shuttle or to the ground which will 
give an indication of a module's health. Tank pressure and temperature, 
thruster pressure, propellant valve motion indicators and temperatures, 
and others will be monitored throughout the mission duration. 

For all of the above, the Shuttle environment and crew safety 
criteria must be accommodated. This may mean venting partially 
expended modules being returned from orbit, providing means for 
propellant dumping of loaded modules and/or tanks, and orienting tanks 
with bladders to avoid subjecting the bladders to damaging loads during 
Shuttle ascent, 

3, GROUND REFURBISHABLE 

In the ground- refurbishable concept, the selection of an 
attitude control propulsion subsystem will follow the criteria of total 
impulse discussed before. The modular concept for a propulsion system 
will still be advantageous here, since on return to the ground, new or 
refurbished modules can be easily replaced, resulting in short turnaround 
time. 

Since return of the complete payload to the ground can be 
considered as a more costly and complex operation than in-orbit 
refurbishment, more attention should be given to the degree of redundancy 
and component reliability for maintenance of attitude stabilization during 
the mission and docking maneuver with the “required degree of reliability. 
Since no need for in-space refueling or module replacement exists, there 
is no problem with fluid or electrical disconnects. 
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The procedure during ground refurbishment in principle 
should be similar to the maintenance practices of scheduled airlines, 
and a study of airline procedures should be of value in establishing 
design requirements. 

The telemetry requirements for monitoring propulsion 
parameters will be similar to those for on-orbit maintainable payloads. 

The Shuttle concept provides the possibility of detailed 
examination of failed and/or matured components which will be an 
important factor in the hardware updating and evolution. This will 
result in longer life components, thus reducing future payload costs. 

D. CONCLUSIONS AND RECOMMENDATIONS 

When cost is the primary criterion, selection of reaction 
control subsystems of greater weight and volume and lower impulse 
efficiency may be preferred. This is possible with the Shuttle because 
of its capability for larger and heavier payloads. The propulsion sub- 
system selection is dependent on the mission; i. e. , expendable, on-orbit 
maintainable, or ground refurbishable. For on-orbit maintainable 
systems (even for high total impulse missions), cold gas attitude control 
subsystems may be desirable. Tradeoff studies are required for 
selection of a cost-effective reaction control subsystem for each of the 
three payloads. Modularization of the RCS should lead to the standardiza- 
tion of two or three thruster levels for a variety of payloads. 
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APPENDIX G. ELECTRICAL POWER 


Analyses should be performed concerning possible cost savings in 
the use of secondary batteries with solar cell arrays in Shuttle payloads. It 
is recommended that Shuttle payloads consider the use of short-life NiCd, 
AgZn, and Pb-acid battery designs for low earth orbit and inclined elliptical 
orbit spacecraft with replacement of the batteries at the end of their design 
lifetimes. Also, battery operating temperatures should be considered, since 
battery operating temperatures influence the cost of batteries. This cost 
must be compared to cost in the thermal control area from relaxed thermal 
design requirements to determine if overall cost savings accrue from wider 
battery temperature ranges. The analyses hinge upon the use of short-life 
battery designs for periodic battery replacement via the Shuttle. 

The use of NiCd batteries for periodic replacement may be less 
expensive over a 10-year operational period in space than one designed to 
endure the entire mission duration. If batteries are designed for long life, 
they are typically designed for low depths of discharge. Conversely, a short- 
lived battery can be designed for deep discharge with little excess capacity. 
Since battery cost is approximately proportional to capacity, it is conceivable 
that smaller batteries replaced periodically would incur less overall cost 
than one set of large batteries without replacement. It can be seen from 
Figure G-1 that designing for shorter life with periodic replacement in 
synchronous orbit will always cost more than designing for 10 years. This 
is explained by the relatively few charge-discharge cycles in synchronous 
orbit. 

The inclined elliptical and low earth orbit cases, however, show that 
a significant cost reduction can be obtained by periodic replacement of short- 
lived batteries. In these cases, the depths of discharge for the five-year 
design period are small (10-20 percent). Substantial gains in battery 
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utilization through high depths of discharge are realized for shorter lifetimes* 
Figure G-1 shows an optimum design life of two to three years* This would 
involve three battery replacements over a 10-year operational period and 
would save 20-30 percent of battery costs in comparison to replacing the 
batteries after five years* 

A battery costs about $220 per kg ($100 /lb)* If launch costs were 
$880 per kg ($400/lb)» the total cost of batteries for 10 years at $1, 100 per 
kg ($500 /lb) would be about $250^000 for a 500-watt spacecraft in either 
inclined elliptical or low earth orbit* Reducing this amount by 20-30 percent 
would yield savings of $50, 000-$75, 000 over a 10-year operational period* 

Wide battery temperature ranges and particularly high battery 
temperatures are detrimental to battery life. Consequently, it is conventional 
to design for narrow battery temperature ranges in long-life applications* 

With the Shuttle, long battery lifetimes and narrow battery temperature ranges 
may not be necessary or desirable* Wider battery temperature ranges and 
lifetimes shorter than the mission life could be accommodated by periodic 
battery replacement. 

Figure G-2 shows the effect of battery temperature on battery cost* 
Batteries normally experience excursions through some part of the 0-40^ C 
range; for exaimple, the batteries may be designed for a 0-10^ C range. 

Thus the average cost incurred over a narrow range such as this must be 
evaluated and compared to the average cost over larger operating tempera- 
ture ranges* 

NiCd batteries are normally used in secondary (charge-discharge) 
battery applications because of their long-life capability* With periodic 
battery replacement, shorter-lived but less expensive battery types may be 
economically attractive such as AgZn and Pb-acid batteries* 

Table G-1 summarizes the battery cost estimates where ”i*' repre- 
sents the battery life (replacement period). 
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Figure G-2. Effect of Temperature on NiCd Battery Costs 
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Table G-1, Battery Costs Per Kilowatt 



Cost ($ / kw) 


Low Earth Orbit 

Synchronous Orbit 

NiCd 

100, 000 

20. 000 

AgZn 


40. 000 


i 

Pb- Acid 

30. 000 
i 

20. 000 
i 


For the AgZn battery in synchronous orbit, a life of several hundred 
cycles and several years seems likely. Sealed Pb-acid batteries show c.onsi- 
derably greater cost savings potential. A lifetime of one to two years in low 
earth orbit would save 70-85 percent of the cost of NiCd batteries. Also, 
rapid charge techniques have been proposed which might allow greater depths 
of discharge and greater savings. In synchronous orbit where two or more 
years life seems likely, the cost saving relative to NiCd batteries would be 
substantial. 

It should be noted that the magnitude of potential cost savings implied 
in the table above could be significantly affected by launch costs. If launch 
costs were assessed on a per kilogram basis, then low weight could be impor- 
tant to low total cost, and the situation portrayed in the table might not be 
realistic. 

It is recommended that Shuttle payloads should consider short-life 
NiCd battery oesigns with periodic battery replacement for low earth and 
inclined elliptical orbit spacecraft as a means of significant cost savings. 

Shorter-life battery designs may be economically attractive with 
periodic battery replacement. Also, long battery lifetimes and narrow 
battery temperature ranges may not be necessary or desirable. Wider 
battery temperature ranges and lifetimes shorter than the mission life could 
be accommodated by periodic battery replacement. The impact on battery 
costs of such a battery design approach must be assessed. 
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Less expensive battery types such as AgZn and sealed Pb>acid 
batteries may be econoi.dcally attractive with periodic battery replacement. 

The results are applicable to both on-orbit maintainable and ground- 
refurbishable Shuttle payloads. The batteries for expendable payloads by 
definition must be designed for mission duration. The Sortie payloads will 
use laboratory- supplied power. 



APPENDIX H. ELECTRICAL DISTRIBUTION 

This analysis is to provide an approach and a set of parametric 
data which will facilitate low cost payload design. Trade-off considerations 
are herein investigated for comparing centralized with decentralized power 
distribution methods. Figure H-1 illustrates the basic differences between 
the two concepts. 

Because of the wide variety in the types and nature of the pay- 
loads » it became necessary to define some payload as a baseline for the 
comparison* The Defense Support F ogram (DSP) satellite was chosen as 
representative of the payloads to be carried aboard the Shuttle. The electri- 
cal load distribution was normalized to that of the DSP satellite. Other 
assumptions are as listed: 

a. 28 volt raw power 

b. 50 percent of satellite power to mission equipment 

c. 50 percent of satellite power to vehicle electronics 

d. Of the 50 percent for vehicle electronics: 

1. 53 percent for communications, data processing, 
and instrumentation 

2. 16 percent for attitude control 

3. 27 percent for stabilization and control 

4. 4 percent for communications and power control 

e. All loads are assumed to require regulated power as 
a worst-case situation. 

f. Cable losses are assumed to be insignificant for 
costing. 

f. Loads range from 100 to 2,000 watts. 

Figures H-2 and H-3 depict the decentralized and centralized 
power distribution modularization concepts, respectively. In each diagram 
the dotted blocks indicate the redundant partner where redundancy is required. 


H-1 



Centralized 



H-2 











H-3 


Figure H-2. Decentralized Power Disiribution 
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Figure H-3. Centralized Power Distribution 






The heavy-lined blocks indicate how the subsystems can be modularized. 

It can be seen that the prevailing philosophy is that of configuring the modu- 
larization so that each redundant segment can be removed without disturbing 
the operation of the other redundant half. This prevents downtime of the 
satellite in the event that a unit has to be replaced. 

In both concepts, raw spacecraft power is received by the 
Power Control Unit (PCU). In the decentralized system (Figure H-2) the 
PCU regulates and switches the primary 28 -volt power to the Load Control 
Unit (LCU) which in turn routes this power to the proper user loads, essential 
or non-essential. The user loads will include localized converters which 
perform the function of converting the primary and 28-volt power to the secon- 
dary voltages required by these loads. The duties of the LCU for the decen- 
tralized system are much simpler than that for the centralized system, 
since only one primary powc r voltage need be distributed rather than many 
secondary voltages. 

Referring to Figure H-3, the raw spacecraft power is received 
by the PCU, dien processed and distributed to the LCU. All active power 
distribution functions (switching and selection of redundant loads or con- 
verters) and most fault -isolation operations will be handled by this unit. It 
receives the processed, regulated 28-volt power and routes it to the proper 
converters, receives regulated secondary voltages from the converters, 
and finally routes these to the proper user loads, essential or non-essential. 
Failure of an essential converter or load will cause the LCU to switch to an 
appropriate operaHe redundant unit. 

The inverters supply a small percentage of the power; hence, 
cost impact as far as tradeoff analyses are concerned is minimum. Con- 
sider, therefore, the case of essential and non-essential converters. The 
weight/watt ratio decreases as the power output increases. Consequently, 
in a decentralized system with smaller converters, the weight will be 
greater than that of a larger converter in a centralized system. This is 
illustrated in Figure H-4. For instance, for 1000 watts power output and 
three mission equipments, the decentralized converters would weight about 
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Figure H-4. Converter Systems Weight/Power Relationships 




22,6 kg (50 lb)» while the centralized converter would weight about 13*6 kg 
(30 lb). To this weight should be added the weight of the PCU and LCU* The 
centralized unit may weigh more because more secondary voltages must be 
distributed. However, it will be assumed here that the same weight applies 
for both cases of about 13*6 kg (30 lb) for the PCU plus LCU units* 

The harness weight depends on the power transmitted, payload 
geometry, and level of redundancy. The wide variation in weights indicates 
the difficulties in assessing the cost. In any case, harness costs are expected 
to be a small part of the total power system cost and are therefore ignored 
in this analysis. 

In assessing the cost figures for an electrical power system (less 
batteries and solar array), data are available which show that the first unit 
cost is directly proportional to weight* Thus a centralized system which is 
lighter than the decentralized one (by 9 kg for the 1000-watt case) will probably 
cost less. However, a centralized converter system with a single converter 
for all loads will imply a greater initial development effort, since small 
converters for a decentralized system of proven design are readily available. 
The development cost of a new system is an order of magnitude higher than 
the first unit cost* Consequently, it will be less costly to use a decentralized 
system, particularly since the small weight penalty involved will probably 
be acceptable for Shuttle payloads. 

There are also other factors in favor of a decentralized system. 

A major drawback of a centralized system is that of reduced flexibility. 

Major changes in payload power requirements could lead to an expensive 
redesign effort. In a decentralized system, the change would only affect 
the particular module supplying the load, and another converter could most 
likely be found among existing designs. A stimmary of other factors favoring 
the choice of a decentralized power supply are tabulated in Table H-1. 

On the basis of this evaluation, a decentralized power con- 
ditioning system is a candidate configuration for a lower cost effect. A 
decentralized system offers lower overall weight and complexity, reduces 
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Table H-2, Power Distribution Comparisons 
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cost, increases reliability, and lends itself to modularization of decen> 
tralized converters to allow individual replacement for fault isolation. 

These conclusions apply equally to Ae on-orbit maintainable, 
ground-refurbishable, and e::pendable types of payloads. Since the Sortie 
payload is retained with the Shuttle during the mission duration, its power 
is received from the Shuttle itself. No separate power source in the pay- 
load is necessary. Load distribution equipment for special Sortie experi- 
ments may be required in the payload. 
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APPENDIX I. BACKUP SYSTEM FOR RETRIEVAL 


A. INTRODUCTION 

Study has been performed to determine a method of providing suf- 
ficient control for retrieval assuming primary vehicle attitude control is 
lost. The study ctxamined various modes of primary attitude control system 
failure and the consequences of these failures on payload dynamics. Since 
docking is a prerequisite for on-orbit maintainable and ground- refurbishable 
payloads, a system must be implemented to assure that retrieval can be 
accomplished in the event of a payload failure. 

In order to perform this analysis on a backup system for retrieval, 
the Large Space Telescope (LST), as proposed by NASA/MSFC f Ref. I-l), was 
selected for analysis. This payload design includes control moment gyros 
(CMGs) for fint- ittilude control and cold gas reaction control system (RCS) 
thrusters foi acquisition, powered flight orbit adjustment, initial CMC spin 
up, and em^»rgc*ncy operation, 1 e CMG momentum management is provided by 

electromagnetic torque control. Since this vehicle represents most of the 
possible failure modes of three-axis controlled vehicles, it is believed 
that the analyses conducte d apply to this general class of payloads. The 
analyses are* described in the following paragraphs. 

Typical primary control system malfunctions were assumed. These 

included: 

1. Electrical power failure during the CMG-cont rolled mode; 
could include a total vehicle power failure 

2. Hardover CMG torque r; could be caused by a failure 
in the torquer positioning circuit; e.g., an open 
feedback transducer 

3. Roll hardover command during RCS-controlled mode; 
could be caused by an attitude sensor failure (The 
roll axis was chosen because, for this vehicle, roll 
attitude acceleration is the highest.) 
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4. Single RCS thruster control valve stuck open; could 

be a mechanical failure; i.e., the thruster would remain 
on although commanded to off 

The resultant effects on vehicle motion, possible fault detection 
schemes based on these effects, possible corrective actions, required 
backup control equipment, and backup equipment available in the LST 
were determined for each of the assumed primary control systems 
malfunctions. 

Assuming that no backup control system was available, the 
steady- state spin rate about the principal axis of maximum moment of 
inertia was also determined for each malfunction. 

Assuming that the steady-state uncontrolled spin was attained, 
and a backup system was available, the impulse required to stabilize the 
vehicle and maintain control was determined for each malfunction. 

Based on results of the above analyses, three operational 
alternatives were studied: 

1* Docking with the uncontrolled satellite after it attained 
steady- state spin 

2. Switching the primary system off and the backup system 
on upon malfunction detection 

3. Switching the primary system off upon malfunction detection 
and switching the backup system on after the satellite had 
attained the steady-state spin, possible shortly before 
rescue vehicle launch 

B. ASSUMPTIONS 

The LST vehicle characteristics are described in Reference I-l. 
Figure I-l shows a block diagram of the attitude stabilization and control 
system, and Table I-l summarizes the system hardware* Nomenclature 
therein is as follows: 

1. Wide-angle Sun Sensors (WASS) - Provide inertial attitude 

reference for transfer to the coarse and fine pointing modes 
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Figure I-l. LST Attitude Sensing and Control Systems Block Diagram 








Table I-l. LST Attitude Sensing and Control System 
Hardware Summary 
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2, Fixed-Head Star Trackers (FHST) - Provide inertial 
attitude reference for reference alignment and coarse 
pointing mode 

3. Reference Gyro Assembly (RGA) - Provides rate and 
position information in all control modes, provides the 
only attitude reference during star tracker or guide star 
occultation periods and slew maneuvers 

4, Magnetometers - Measure earth's magnetic field for 
electromagnetic control computations 

5. Digital Control Units (DCUs) - Receive data inputs from 
the various sensors and provide outputs to the CMG. 
magnetic torquer. and RCS electronics; also provide 
gyro compensation using other sensor and/or ground 
update information 

6* Transfer Assembly (TA) - Provides interface to bring 

configurations of sensors and actuators on-line as required, 
routes signals, and provides failure isolation; also provides 
low level processing for fault detection, signal processing, 
switching logic, and command implementation and includes 
emergency operational circuitry to permit the spacecraft 
to acquire the sun using only this circuitry in conjunction 
with the WASS, PGA, and RCS 

7. Control Moment Gyros (CMGs) - Provide control torques 

for vehicle stabilization in the coarse and fine CMG control 
modes. [Six CMGs are oriented (as shown in Figure 1-2) so 
that their momentum vectors are constrained to lie in the 
planes of the six sides of a right hexagonal pyramid, of 
which the slope of the sides of the pyramid is 524 mrad 
(30 deg) with respect to the base.] 

Four active CMGs provide momentum values up to 678 N-m-sec 
(500 ft-lb-sec) in the X-axis. 1017 (750) in the Y-axis, and 1186 (875) 
in the Z-axis. Only three active gyros arc required for satisfactory 
ASCS performance; therefore, four failures are required before performance 
is degraded. However, this high degree of redundance may not be available 
in other vehicles. Therefore, the results of reduced control were examined 
briefly, as will be shown later. 

The reaction control system is as shown in Figure 1-3. It is 
assximed that signals from the pressure transducer just ahead of the 


1-5 



Six CMGs Employed: 

N\junbers Z, 3, 5, & 6 are operational. 
Numbers 1 & 4 are standby. 


X 



♦ 


Figure 1-2. Orientation of CMGs on LST 
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pressure regulator will be used to switch open the ti nk isolation 

valves in sequence as the gas is used. Each of the four thruster modules 
contains two active and two standby thrusters. Each pair of thrusters 
can be isolated by the normally open latching solenoid valves shown; 
therefore, should a thruster stay open, it is assumed that the pair would 
be shut off by applying power to the closing solenoid of the isolation valve. 
The four GN 2 tanks have a total capacity of 114 kg (252 lb) of gas w^.th a 
specific impulse of 70 seconds. The thruster modules are assumed to 
be installed as shown in Figure 1-4 with the following characteristics: 



Pitch 

^oll 


Yaw 

Thrust level per 

44. 5 or 2.2 

44. 5 or 2 

2 

44. 5 or 2. 

thruster ~ N (lb) 

( 10.0 or 0. 5) 

( 10. 0 or 0. 

5) 

(10.5 or 0. 

Minimum impulse bit 

0.44 

0.44 


0.44 

per thruster ~ N-sec 
(lb-sec) 

(0. 10) 

(0.10) 


(0. 10) 

Moment arm ~m (ft) 

4. 15 
(13.60) 

1.52 
( 5.00) 


4.15 

(13.60) 

Vehicle moment of 

125,000 

17, 700 


130, 000 

inertia y kg-m^ 
(slug-ft ) 

(92,400) 

(13, 040) 


(95, 700) 

Angular acceleration 

2. 910 

7.660 


2.840 

(10-lb thrust level) ^ 
mrad/sec'^ (deg/sec^) 

(0. 167) 

(0.439) 


(0. 163) 


C. ANALYSIS 

1. ELECTRICAL POWER FAILURE WHILE STfSTEM IS IN THE CMG- 
CONTROLLED MODE 

As stated earlier, it was assumed that 4 CMGs are active 
normally and that they can provide up to 1186 N-m-sec (875 ft-lb-sec) 
of momentum in the Z axis. If electrical power to the CMGs is 
interrupted, the rotor spin motors, as well as the gimbal torque rs. 
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de-energized. If no external disturbing torques are present* there will 
be no initial effect. If external torques are present* the system will have 
sluggish response; however* the vehicle will still remain under control* 
because the spinning rotors will oppose the change in momentum required 
by the external torques. Eventually* due to energy dissipation* the rotors 
will spin down, and thei r momentum will be transferred to the vehicle. 

In the steady state* assuming the absence of external torques, the vehicle 
will attain a constant spin rate about the principal axis of steady- state 
spin rate* as shown in Table 1-2 was found to be about 9.08 mrad/sec 
(0.52 deg/sec). Table 1-2 also shows that about 87.2 N-m-sec (64.3 
ft-lb-sec) of RCS impulse or 0.42 kg (0.92 lb) of GN^ would be required 
to stop the spin. 

It can be seen that the pitch moment of inertia is very nearly 
equal to the jaw moment of inertia. Under these conditions, the spin 
about the yaw axis is lightly stable* so that any relatively small disturbing 
torque will produce rather large and slow- subsiding vehicle oscillations 
about the other two principal axes. 

The above considerations are important with respect to the 
feasibility and advisability of docking with the uncontrolled vehicle. More 
about this will be discussed in the following Section D. 

The most obvious way to detect this failure is to monitor the 
rotor speed* Of course* a more general vehicle power failure would be 
indicated by a power-off electrical power system status signal. Either 
of these signals could be used to switch-in the backup RCS (or the primary 
RCS in the LST if it is operational). Whether the backup RCS is switched-in 
at this time or just prior tc rescue vehicle launch is subject to other 
considerations which will be explained later. 

Backup equipment required for this failure, as well as those 
included in the LST design are listed in Table 1-2, 
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Table 1-2, NASA Shuttle Payload Backup Control Criteria 
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HARDOVER CMC TORQUER 


As shown in Table 1-2, this failure would have negligible effect 
except for reduced control capability in this mode. It, in a particular 
vehicle design, insufficient control capability were left after this failure, 
possible corrective actions and backup equipment would be required. 

The Table also lists the backup equipment available in the LST design. 
With respect to the *’Steady State Uncontrolled Motion’* listed for this 
type of failure, it should be clarified that the attitude errors and rates 
actually pertain to controlled motion in this control mode since it is 
assumed that enough controll capability remains after the failure. Sub- 
stantially reduced control would produce larger attitude and attitude rate 
errors. 

3. HARDOVER COMMAND IN ROLL IN RCS-CONTROLLED MODE 

This type of failure would create an ever-increasing roll rate 
until either the malfunctioning RCS were switched out or the propellant 
were depleted. If one full tank of propellant were allowed to deplete. 
Table 1-2 shows that the resulting roll spin rate would be about 1.69 
rad/sec (97 aeg/sec), and the resulting centripetal acceleiation at the 
tip of the solar panels would be approximately 1.8 g*s. After a rather 
long period, depending on energy dissipation rate, this momentum would 
be transferred into the principal axis of maximum mi ^nt of inertia, 
producing a yaw rate of about 226 m rad/ sec (13 deg/t- . The impulse 
required to stop the steady-state spin is also shown. 

In case of a depletion of four tanks of the resulting 

rotational rates and centripetal accelerations would be much more 
severe, as shown. 

It is clear that this failure requires fast switch-off of the mal- 
functioning RCS. Whether the backup RCS is switched in immediately 
or delayed until just prior to rescue vehicle launch is subject to other 
considerations to be discussed later. 
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4. SINGLE RCS THRUSTER CONTROL VALVE STUCK OPEN 

The sequence of events following this failure depends on complete 
system dynamics and design characteristics; however, it is believed that 
the results obtained in the following analysis illustrate the most severe 
case* 


Figure N4 shows typical phase-plane roll and yaw loci for 
off-on control* The pitch plot would be identical but is not needed for 
this discussion. Figure 1-4 also shows the thruster arrangement. Simul- 
taneous firing of 1 and 2 or 3 and 4 would produce yaw moments plus 
lateral acceleration in the Y-axis direction, and simultaneous firing of 
5 and 8 or 6 and 7 would produce pitch control plus lateral acceleration 
in Z-axis direction. On the other hand, firing any roll control thruster 
alone would produce roll plus yaw in addition to some lateral acceleration 
in the Y-axis direction. 

It is assumed that the following sequence of events develops: 

a* At time t^, the roll and yaw states are as shown, and 
thrusters 1 and 3 fire to correct the roll error. 

b. At time tj, the roll command signal is switched off, but 
thruster 1 remains open, so the negative roll rate keeps 
increasing until, at time t2» it hits the - 17. 5 mrad/sec 
(-1 deg/ sec) roll rate limit. Some yaw moment develops 
in this time interval, but, due to the low yar acceleration, 
no significant yaw motion occurs. 

c. At time t 2 t the autopilot commands thrusters 2 and 4 to 
fire in order to stop the roll. Thrusters 1, 2, and 4 are 
now firing. The increased yaw acceleration causes the 
yaw rate to increase, until, at t 3 , it reaches +17. 5 
mrad/sec (+1 deg/sec) limit. 

d. At time the autopilot commands thruster 3 to open in 
order to stop the yaw rate. Thrusters 1, 2, 3, and 4 
are now open. 

e. At time t^, the autopilot commands thrusters 2 and 3 to 
close because they are opposing and cancelling each other. 
At this time, the magnitude of the roll rate is something 
less than - 17. 5 mrad/sec (-1 deg/sec), and the yaw rate 
is approximately +17.5 mrad/sec (+1 deg/sec). No net 
moment is applied since only thrusters 1 and 4 are firing. 
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There are many p>ossible sequences following time t^, but it is 
felt that this is the condition of highest possible rates in pitch and yaw. 

It is assumed that, at propellant depletion time, this is the prevailing 
state; therefore, it may be assumed that the initial condition on the 
ensuing free body motion is: 9^ = 0., = - 17. 5 mrad/sec (-1 deg/sec), 

and = +17. 5 mrad/sec (1 deg/sec). 

D. RESULTS AND INTERPRETATION 

Although for some failures, the resulting steady- state uncontrolled 
motion is a rather slow spin, it has been pointed out previously that this 
vehicle has two principal moments of inertia that are nearly equal. This 
characteristic causes the spin about the Z-axis to be very lightly stable 
so that, in the presence of external disturbing torques, rather large and 
slow- subsiding oscillations about the other two axes would be expected. 

Also, for the roll hardover command malfunction, the resulting yaw 
steady-state spin is shown to be at least 227 mrad/sec (13 deg/sec). 

This value is substantially larger than the allowable 1. 75 mrad/sec (0. 1 
deg/sec) specified in the Orbiter docking specification (Ref* I-l) . Further- 
more, the acceleration at the solar panel tips due to the steady roll spin 
was found to be about 1.8 g^s. This value exceeds the allowable 1.5 g*s 
specified in Reference I-l. 

These considerations indicate that, for three axis-controlled 
vehicles, docking with the body in an uncontrolled steady- state spin is 
not feasible for the roll hardover command failure and that prompt attitude 
stabilization is required from a backup system to prevent vehicle damage. 

Docking with a tumbling body has been investigated (Ref. 1-2). 

The preferred approach is to include a self-propelled, self- stabilized 
**third” vehicle designated as the “Module for Automatic Dock and Detumble 
(MADD)“. However, until the feasibility and cost effectiveness of such a 
device are approved, backup control is preferred for three-axis active 
controlled vehicles. 

*The feasibility of docking with a port normal to the Z-axis was being 
considered. 
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The above reasoning suggests that, at least for some malfunctions; 
e. g. , roll hardover conunand in the RCS-control mode, automatic mal- 
function detection and primary control system switch out logic are required. 
It remains to be decided whether the backup system should be switched in 
immediately'^' and automatically or by ground command prior to rescue 
vehicle launch. Some considerations pertaining to these alternatives follow. 

The amount of gas impulse required to restabilize the hardover 
command case would depend on the time required to sense the malfunction 
and on whether the restabilization occurs while the vehicle is still spinning 
about the roll axis or whether sufficient time has elapsed for the momentum 
transfer to the yaw axis to occur. This is due to the fact that the yaw RCS 
lever arm is 4. 15 m (13. 6 ft), while the roll lever arm is only 1.5 m (5 ft). 
From this point of view, it would be more advantageous to switch in the 
backup RCS just prior to rescue vehicle launch. 

Table 1-2 shows that the amount of required to maintain 
unforced limit cycle attitude control is very small (only about 0.0045 
kg/hr). Due to external disturbance torques (at this altitude mostly 
gravity gradient and magnetic), the actual amount could'^’®'’*' be higher; 
however, it would still be very small, so that NASA’s proposed 30- day 
RCS control would not impose a serious weight penalty. Nonetheless, 
this consideration also favors delaying the backup RCS switch-in. 

The reliability of the backup system, once it is switched in, 
would be obviously higher if it is switched in later so that the required 


♦ For the LST, there is enough sensor redundancy to be ^ble to 
switch in the backup RCS immediately; however, if the backup 
rate gyros were the only available sensors, a minim tun time 
of about 10 minutes would have to be allowed for gyro spin up 
and warm up. 

♦♦ Rotational impulse is equal to T (At) where TAt is total 
impulse (N-sec) and i is the torque lever arm. 

It is well known that a forced limit cycle may require less 
ACS propellant. 
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proper performance time is reduced. However, reliability would be 
enhanced by elimination of the backup receiver and command link as 
explained below. 

An advantage of automatic switching in of the backup RCS upon 
malfunction detection is that ?t would be autonomous and, therefore, 
independent of the ground command link. A backup command receiver 
(as listed in Table 1-2) would not be required.^ Another possible advantage 
of automatic immediate switching in of the backup RCS could be that mission 
operations and/or experiments could still be conducted until the rescue 
vehicle arrives. 

A possibly significant disadvantage of immediate backup RCS 
switching to continue operation for a rather long period before rescue is 
that it may require a complete backup electrical power supply system. 

It is apparent that a clear cut choice between the alternatives of 
switching in the backup RCS immediately upon malfunction detection or 
waiting until just prior to rescue vehicle launch is not possible. For 
each satellite design, then, the designer would have to evaluate consid- 
erations as explained above. For the LST, unless continued RCS 
operation for the 30 days is a hard and fast requirement, it is felt that 
delayed switching is to be preferred. If, on the other hand, prompt 
rescue launches can be assured, automatic switching would be preferred. 

E. CONCLUSIONS 

The foregoing analyses and results leas to the following 
conclusions: 

1. Docking with the uncontrolled payload is not feasible for 
the roll hardover malfunction and is not recommended 
for the case of other malfunctions for the vehicle studied 
because of marginal Z-axis stability. 


♦ A reliable telecetering down link would be required anyway, since 
it would not be reasonable to risk a rescue mission without prior 
knowledge of distressed vehicle attitude control. 
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2, A simple backup RCS should be provided • It should 
include, at least, the following equipment: 


Component Weight^ 



(kg) 

(Ib) 

4 Thruster Modules 

9.1 

20 

1 RCS Electronics 

8.3 

16 

3 Rate Gyros 

10.9 

24 

1 Switching Assembly 
Propellant Supply (1 Tank, 

4.5 

10 

valves, lines) 

56.7 

125 

Propellant (GN^) 

28.6 

63 

Command Receiver 

15.4 

34 

Electrical Power Supply 

317. 5 

700** 

Total 

450.0 

992 


The LST includes the necessary backup equipment, except 
for the rate gyros, but includes redundant attitude sensors 
to provide the same function. 

3. A malfunctioning CMC control system may have no 
significant effect; therefore, not all malfunctions of this 
type of system require switching the system off and the 
backup system on. 

4. For those malfunctions that require switching off the 
active system, the switching off should be done immediately 
upon malfunction detection. 

5. The alternatives of switching on the backup RCS system 
immediately after switch off of the active malfunctioning 
system, or switching it on just prior to rescue vehicle 
launch, must be evaluated for each vehicle design. 

F. R EC CMM END ATIONS 

It is recommended that, until and if successful and cost-effective 
docking with a tumbling body as proposed in Reference 1-2 is demonstrated, 
provisions be incorporated in on-orbit maintainable and ground- ref urbishable 


^ Weights are typical and are extrapolated from data in Reference I-l, 

** Assuming a completely redundant electrical power supply system 
for continued operation of at least 30 days. 
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satellite designs for stabilizing t’^e vehicle after failure of the primary 
stability control system. The backup attitude control system should 
include, at least, the equipment listed in the ’‘Conclusions ** subsection 
of this appendix. 

It is desirable, as in the case for the LST, that redundant primary 
control capability be incorporated in the vehicle design for reasons of 
mission operational reliability. In such a case, no additional backup 
control equipment is required. 

The decision as to whether the backup control system should be 
switched in shortly after malfunction detection and primary control system 
switch off or first prior to rescue vehicle launch should be made for each 
design. Some considerations pertinent to this decision are included in 
subsection D of this appendix. 

It should be noted that the analyses, results, conclusions, and 
recommendations herein are believed to apply, in general, to three-axis 
active-controlled vehicles. No investigation of the basic problem has 
been conducted with respect to other types of vehicles; e.g., spin- 
stabilized and gravity- gradient stabilized satellites. 
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APPENDIX J. GROUND OPERATIONS TIME 


A. INTRODUCTION 

Based on the massive amount of documentation related to the overall 
concept of the low cost Shuttle system, the review of information directly 
related to payload operations, and the results of a specific examination in a 
previous study (Ref. J-2), it was apparent that the present way of conducting 
prelaunch operations is not in consonance with the Shuttle concept. Pre- 
launch operations presently require from as little as 8 days for a very 
simple payload to as much as 60 days for a very sophisticated payload with 
a nominal median of 20-25 days. The foregoing data were used in the previ- 
ous study and led to the realization of the time impact on the Shuttle. This 
subsequently caused the investigation of the potential for reducing the time 
required for prelaunch operation. The preliminary results show that it is 
feasible and reasonable to expect that prelc^unch time can be reduced to the 
order of 10-12 days, or approximately half of the present requirement. This 
time increment has been the basis for comparison and a potential goal for 
achievement (see Figure J-1). 

B. APPROACH 

The approach was to analyze the prelaunch operations for a group 
of payloads representative of the four types of payloads considered; identify 
the prelaunch operations having the capability for reduction of time; con- 
sider changes for the design of the payload, the facility and equipment, and 
operational procedures; and develop candidate design guidelines for the 
accomplishment of time reduction for the payload prelaunch operations. 

The prelaunch operations analyzed for po^’ential time reduction were 
obtained for 24 payloads which are typical Shuttle payloads and which include 
examples representative of the four types specified for this study. The data 
sources were: 

1. Martin Marietta Corp. Operations and Checkout Plan for Pay- 
load Carriers reports (Ref. J-3). Included 12 NASA payloa is 
for the Shuttle. 
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Figure J-1. Approach to Reduced Payload Prelaunch Operations 



2. McDonnell Douglas Astronautics Co* DOD Space Transportation 
System Payload Tnterlace Studies (Ref. J-4). Covered three 
specific DOD payloads for the Shuttle. 

3. General Dynamics /Convair Aerospace. Space Tug Launch Site 
Service Iiiterface Study (Ref. J-5). Covered typical payload/ 

Tug opeiations. 

4. Aerospace Corporation. Payload Analysis for Space Shuttle 
Applications Study (Ref. J-2). Included information related 
to a large number of predominantly NASA payloads. 

5. Aerospace Corporation. Prelaunch Operations were obtained 
for five current payloads having typical and peculiar operations. 

Using the data from the above sources, r matrix was developed 
incorporating a composite list of all of the prelaunch operations conducted on 
all of the payloads, and the time required for each operation was identified. 
These data were correlated and ranked in a list according to time and are 
presented in Table J-1. This list .^ot a complete list of operations, but it 
is comprised of those operations considered as having the potential for rela- 
tively significant time reduction and was used as a guide in selecting areas 
for further investigation. 

An analysis of these operations was conducted to determine the 
source and reasons for the ’’excessive” time requirements, and efforts were 
concentrated reducing the time needed for those items. The criteria used 
for the development of the design guidelines associated with these operations 
included consideration of completely eliminating the operation, modifying 
existing methods, combining and/or conducting operations concurrently, and 
developing new design for the payloads, the supporting equipment and the 
operations. In addition, full advantage was taken of the capabilities that may 
exist in the low cost Shuttle payload design philosophy (Ref. J-6), where the 
concept basically provides over -design and modular l^^ v density packaging. 
The assumptions made for this study are basically the same as those that 
were made or the preliminary approach to the 10-12 day timeline for pre- 
launch operations and consist of the following: 

1. The payloads are complete and ’’flight ready” when received 

at the Prelaunch Processing Facility (PPF) on the launch base. 
Each unit is an all-up assembly, has been previously subjected 
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Table J-1. Time Ranking of Payload Operations 


Operation 


Range 

Median 

Payload Functional Testing 

1-14 

7 

Tug Mate 

1-6 

3 

Preps for Mate to Orbiter and Tug 

2-4 

3 

Interface Verifications 

t-4 

2 

Leak Testing /Propellant Loading 

1-3 

3 

Receiving and Inspection (1st Day) 

1-3 

3 

Weight and Balance 

1-2 

2: 

Inrtallations 

1-2 

1.5 

Closeout Flight Preps 

1-2 

1.5 

Simulated Flight 

1-2 

1 

Ordnanc Checkout and Installations 

1/2-2 

1 

Non-Hazardous Servicing 

1 

1 

Contamination Control 

1-2 

1 

Transportation and Handling (Each Instance) 

1 

1 


to a full integrated system test (1ST) and may require servicing. 
The assembly of certain small items which incur little time cr 
risk may be excepted, such as protecti/e covers/caps, sp'c’ = l 
supports for transpoi Nation, and other accessory type iter 
It is recognized that a few payloads will require the assen > v 
of some major items and 'hese c».n be accommodated. 

2. The payloads are generally "optimized” and modularized witn 
respect to the standardization oi the basic supporting structure 
and* to a large degree* the basic housekeeping subsv' terns. 

3. The payloads are designed to utilize standardise'^ f: 3 t, check- 
out, servicing, and other support equipment v. ai 1. will be 
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furnished at the launch base for payload use. This specifically 
includes the Unified Test Equipment (UTE), the Launch Pro- 
cessing System (LPS)» or other equivalent universal automatic 
type test equipment. 

4. Th payloads are designed to be man-safe. This includes 
fluids propulsion, pyrotechnic, electric power, and all other 
subsystems. 

5. The payloads are designed to retain a maximum amount of 
autonomy; interfaces with the Orbiter and Tug will be 
minimized. 

While the foregoing assumptions are basically payload design guide- 
lines, the realization of their incorporation into the payloads for the Shuttle 
is dependent on the detailed design guidelines as may be developed and imple- 
mented for each oi them. 

C. ANAI. 

1. RECEIVING, INSPECTION, AND INSTALLATION 

The receiving and inspection of the payload have been shown to require 
as many three work shifts, while 1.5 shifts are required for installing the 
various payload equipments. In order to reduce the total rime for these oper- 
ations, they will be conducted serially in the overall flow of ope^ lon and con- 
currently to the maximum extent possible. For this reason, the two opera- 
tions have been treated together in this section. 

It is expected that the time required for the combined operations can 
be reduced to not exceed two shifts because the payload will be delivered to 
the prelaunch processing facility in a '’flight rea^^’y" condition, experienced 
launch base personnel will be performing many o'^er^tions normally sup- 
ported by payload personnel, and many of the operations will be conducted 
concurrently. During these operations, the payload will be removed from 
the transporter and installed on the payload processing fixture, and the man- 
agement of the contamination control and associated equipment will be accom- 
plished by launch base personnel. Concurrently with the receiving inspection 
of the payt ad, the transportation environmental monitoring record will be 
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oxarnin».‘<l . rorlain non-flight items will be removed, and the installation of 
the few payloa^J <‘quipnM?nt items will commence. The dedicated payload pro- 
cessing bay m the far ility will be ready for the payload, the launch base sup- 
port c*quipmcnt will have becm scheduled and available, and any payload • 
peculiar support equipment will have been integrated and the compatibilii;y 
with the ’"'unc h base system established prior to the arrival of the payload. 

To accomplish this, two guidelines should be adopted: 

a. The? payload shall be basically designed for delivery in the 
'flight ready * condition, and the amount of equipment to be 

assembled following delivery shall be minimized to the 
greatest extent possible. 

b. The design of the payload and any equipment to be assembled 
following delivery shall provide simple, fail-safe, low-risk 
interfacing hardware with sufficient accessibility to enhance 
the ease of assembly and preclude damage. 

2. WEIGHT AND BALANCE 

This operation typically requires two work shifts, or approximately 
16 hours, during the payload prel mnch operations. The time is completely 
dedicated to the procedures; the concurrent performance of other tasks is 
precluded. The Space Shuttle Baseline Accommodations for Payloads docu- 
ment (Ref. J-7) generated by NASA requires that the precise payload mass 
center of gravity must be established prior to installation in the Orbiter; 
however, the requirements for maintaining the mass properties of the pay- 
loads far exceed the requirements for the purpose of determining the center 
of gravity of the loaded Orbiter. The weighing operation may be conducted 
prior -o the prelaunch operations cycle. This i;, consistent with the receipt 
of a **flight ready'^ satellite, and it is recommended that the physical weight 
and balance operation be eliminated from the payload prelaunch operations. 

With the elimination of this operation, the problem arises of con- 
trolling the mass properties of the payload in the event that module or other 
equipment changes becotnc necessary during prelaunch or in-orbit operations. 
This may be handled by maintaining strict accuracy and control over the 
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payload data book and incorporating the following design guideline as 
appropriate to the particular payload: 

The interchangeability designed into the payload nnodulcs and 

other replaceable equipment will include the requirements for 

m?ss properties interchangeability. 

x"he replacement of a payload module while on-orbit with a module 
that is heavier, due to updated design or other changes, also creates a pay- 
load mass properties problem. The following two guidelines provide an 
approach to solving this problem: 

a. The payload design nray incorporate ballast mounting recep- 
tacles, if necessary, in sufficient quantity and located appro- 
priately on the payload to accommodate changes that may 
occur that violate the mod' le interchangeability. The ballast 
may be added or removed manually as required on the ground. 
The design of the balancing system equipment will be reeuired 
to have the capability for on-orbit changes to be performs. J 
remotely by the manipulator arms. Quick-disc nnect tapered 
plugs of various materials may be considered as one approach 
for the weight/receptical design. 

b. The payload design may incorporate electro-mechanical 
device(s), if necessary, to adjust the mass properties of 
the payload by moving ballact weights on command. The 
weights may be mounted on rods which are oriented prop- 
erly to obtain the effective spatial weight location and may 
be moved by screw or other action. At least two types of 
such devices are presently being used successfully, one of 
which is used on a spinner ^nd the other on a 3-axis con- 
trolled satellite. 

3. LEAK TEST AND PROPELLANT LOADING 

These operations are almost always conducted in series, and the 
time required for the overall procedu is nominally three work shifts. 
Presently, leak testing is accomplished by pressure /time monitoring and 
bubble or sniffer testing of each potential source, both of which allow to a 
limited d ^gree the concurrent performance of other tasks but leave some- 
thing to be desired in terms of accuracy, A third method used is to bag the 
entire .. , ’oad, charge the system with an inert gas seeded with a low level 
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radioactive tracer ges» circulate the bagged mass of air through an analyzer, 
and monitor for total allowable system leakage. An accessory probe is used 
to isolate the individual source(s) if required. This method is effective and 
highly accurate but requires dedicated time for the bagged portion of the oper- 
ation. Since this method readily lends itself to accomplishing a significant 
reduction in time, ind is in consonance with verification testing of highly reli- 
able payloads, it is recommended for use in the Shuttle. The payload, the 
launch base facilities, and the equipment associated urith leak testing are 
similar to and are combined with those for the propellant loading operation. 

The propellant loading and final pressurization operations are pres- 
ently slow processes that are accomplished by a minimum number of person- 
nel for safety reasons and require dedicated time. In addition, all other per- 
sonnel not directly supporting the operation are evacuated from the entire 
area so that other tasks in the total support system as well as those associ- 
ated with the payload cannot be performed concurrently. In order to reverse 
this situation and accomplish this operation in a safe, rapid manner, while 
allowing a large number »f other tasks to be conducted concurrently, the 
following design guidelines should be considered: 

a. Design the fluid systems for payloads and servicing equipment 
to working pressure-to-burst ratios sufficient to meet the 
safety requirements that will permit conducting other opera- 
tions concurrently with fluid system servicing operations. 

b. Design the fluid systems to minimize the number of sources 
for leaks. 

c. Design to maximize the use of brazed or Ided couplings for 
system components as well as the normal plumbing. 

d. Eliminate the requirement for ''one-more-time ’ flushing, 
draining, and purging during prelaunch operations This 
action may be taken by relying on previous operations, qual- 
ity control, and by taking advantage of the system redundancy 
features and the elimination of single point failures incor- 
porated in the payload design. 

e. Increase the rate of fluid flow for loading and unloading oper- 
ations. This may be accomplished by designing larger pay- 
load fill and drain lines, couplings, and larger capacity com- 
ponents associated with the systemis. 
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f. The ground support equipment for both leak testing and fluid 
servicing should be designed as standardized equipment fur- 
nished for payload use at the launch base. The concept of 
this equipment is envisioned as consisting of self-sufficient, 
highly mobile units which will be used to service the several 
payloads in process in the prelaunch operations facility. The 
units may also be used for operations conducted at other on- 
base facilities including p>ayload assembly and integration, 
storage, post-landing, and refurbishment areas. The equip- 
ment will be operated by experienced latmch base personnel. 

In addition to expediting propellant loading and unloading, the use of 
larger fill/drain couplings also provides capabilities that arc both required 
and beneficial to the system. To provide the level of safety required for con- 
current operations, the payload /ground system coupling design will incor- 
porate multiple redundancy features to positively seal and lock the connec- 
tions to assure the pr^^vention of incipient or accidental leakage and unin- 
tentional disconnect. The safest design should be implemented, and deci- 
sions should not be made on the basis of payload vs ground equipment con- 
nector considerations. The larger coupling could also enhance the capabil- 
ity, safety, and time considerations in conducting on-orbit servicing opera- 
tions, and the increased sizes of other components may be used to advantage 
in detanking or jettisoning operations. 

By implementing th • above design guidelines for the payload and the 
support equipment, the total time required for leak testing and propellant 
servicing should not exceed 1.5 work shifts. 

Consideration should be given to factory (or launch site assembly) 
loading of propellants and gases with hermetically sealed tanks. No thruster 
testing is then possible in the prelaunch operation and propellant or gas 
valves can be only electrically tested for continuity of the circuit and valve 
stem motion (if proper indicators are provided). Such a procedure is adopted 
in one of the operational ICBMs and when applied here would result in simpli- 
fication of the prelaunch procedure. 

4. PAYLOAD FUNCTIONAL TESTING 

Functional testing over the years has progressed toward the **ship 
and shoot’* concept. This philosophy, while attractive, will probably never 
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be fully realized. However, further progress toward this end has been 
shown to be feasible and demonstrated to be possible and is in fact a neces- 
sary ingredient in the overall Shuttle concept. This has been reflected to 
varying degrees in all of the various studies ana other literature related to 
the Shuttle in general and to payload operations in particular. The approach, 
as applied to satellite type payloads is not without precedent, since at least 
one program has successfully launched sophisticated satellites under the 
10-12 day goal mentioned in this study and demonstrated the capability of 
further improvements. This is an exception and great effort in many areas 
was required in achieving this capability for one type payload. These same 
efforts will be necessary in implementing this approach for the Shuttle so 
that, by proper management of planning and design, the time required for 
testing of the large quantity of payloads to be processed may be reduced to 
contribute to the cost effectiveness of the overall system. 

The time for functional testing has been shown to require as much 
as 14 work shifts; however, most of the payloads examined required times 
close to the median of 7 shifts. Approximately half of the payloads 
examined were based on their application to the Shuttle, and improvements 
in reducing the time required for testing were already reflected to some 
extent in the data. This could be seen in comparing the median of ^ 
shifts shown in this data to the 11.5 days shown for testing in the data col- 
lected for our previous study (Ref. J-2), which was based on the prevalent 
way of testing today. 

In order to achieve the reduction of time to the level of approximately 
seven shifts, or three days for this study goal, the general philosophy previ- 
ously mentioned must be implemented for the Shuttle payloads. The prime 
element in the recommended test philosophy is to reduce payload testing at 
the launch site, particularly during the operations in the prelaunch process- 
ing facility. The driving factor in reducing this testing is in lowering the 
level of the tests conducted. The extent to which the level of testing is low- 
ered may be determined by tradeoffs, including payload reliability /availability 
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requirements, risks, time, costs, and other factors which will be different 
for each individual payload program. No attempt has been made to firmly 
define the level of testing. However, the trend and direction of the recom- 
mended philosophy is indicated and has been amplified sufficiently to show 
some of the methods for and the results of reducing the time for payload pre- 
launch testing to what is considered a nominal minimum limit. 

In the planning of prelaunch test operations and in the design of the 
payload test equipment, and other support equipment, consideration should 
be given to the folio ig guidelines: 

a. In the design of the payload and the supporting test equipment, it 
should be emphasized that testing during the prelaunch oper- 
ations will be tc establish flight readiness verification. This 

is essentially status type testing, which is basically designed 
in most cases to isolate down to the replaceable module level. 
The guide to be used is that the prelaunch testing will, as a 
minimum, identically duplicate whatever on-orbit, pre- 
release, flight-readiness -type functional testing is defined 
for the particular payload. 

( Note : The capability will exist in the test equipment to con- 
duct in-depth payload performance testing. However, this 
type of testing during the prelaunch operations cycle is not 
considered as the baseline, since it conflicts with the basic 
payload design and ilight readiness verification testing con- 
cepts for the Shuttle. While such testing would require more 
time, and be expensive in terms of software and other factors 
for some programs, it may be implemented to accommodate 
justified cases. Generally, only critical portions of the pay- 
load should be subjected to this level of testing. ) 

b. Payloadr should be designed to interface with and utilize uni- 
versal-type test equipment. This equipment is characterized 
by the Unified Test Equipment (UTE) (Ref. J-8) or the Launch 
Processing System (LPS) (Ref. J-9) concepts, and may also 
be used in the payload ground refurbishment cycle and at the 
factory. This type of equipment has also been considered 
necessary (Ref. J-10) to accomplish the required l60-hour 
turnaround cycle (Ref. J-1) for the Orbiter. 

c. Payload design shall include features t\at will contribute to 
the reduction of time required to perform configuration setup 
and teardown for test operations. These are pres itly 
extremely time-consuming operations and, while significant 
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reductions are inherent in the reduced tejt.ng concept, further 
reductions may be realized. Payloads should be modularized 
and incorporate simplified standardized test connectors of all 
types, builtin hat antennas, alignment aids, and other small 
items that would not require removal from the satellite. 
Location of payload equipment should consider concurrent 
operations and eliminate requirements to reorient or other- 
wise move the payload. 

d. The payload design should provide whenever possible for auto- 
matic, remotely controlled, or fully accessible calibration 
features for the applicable equipment. 

e. Payload equipments requiring highly precise physical align- 
ment should be designed for the accomplishment by self- 
contained means wherever possible. Replaceable equipment 
will conform to interchangeability design requirements or 
have been previously assembled to the payload and designed 
alignment retention capabilities will be utilized. Manual 
alignments will be minimized to the maximum extent possible 
but where required will be accomplished using payload refer- 
ences. Accessory optical aids may be designed as an integral 
part of the payload or temporarily mounted to accurate pay- 
load reference positions. 

f. Payload and support equipment design shall include provisions 
for module replacement in a safe rapid manner. Require- 
ments for accessibility and orientation may be driven by 
ground rather than on-orbit operations due to the presence 

of folded antenna, solar arrays, support fixtures, test equip- 
ment, and a 1-g environment. 

g. The design of payloads will include the incorporation of elec- 
trical interface test points that are an integral part of the 
interfacing equipment- Tests are delayed and large amounts 
of time are often expended in determining if an indicated prob- 
lem is in the payload, the test equipment, or the various inter- 
facing connections. Incorporation of these points will reduce 
the time required to isolate malfunctions and identify the 
offending unit without breaking the interface, provide a simpli- 
fied rapid means to positively verify an interface, and may be 
used in all phases of ground testing. 

5. transport: ' N and handling 

The ground transportation of the payload, and the associated han- 
dling and preparations, are shown to typically require one full work shift 
eacii time the payload is moved from one place of operations to another at 
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the launch base. Some of the movements that have been proposed ir norn al 
flows of operations include moving to a safe area for propellant loading and 
pressurization, to a special area for EMI tests, to other areas for simulator 
and Tug mating, and still others for simulator and Orbiter mating. Move- 
ments in some of the more specialized cases include to and from facilities 
used for payload sterilization, installation of specialized pyrotechnics, and 
short-term and long-term storage. 

In addition to the above prelaunch transportation operations, there 
are those associated with the on-base payload refurbishment cycle opera- 
tions, the movements to and from the launch stand in accomplishing the 
quick-change of payloads, and the transportation of payloads from the fac- 
tory to the launch base. While the design guidelines are directed toward 
reducing the time for prelaunch operations, they also apply to the other areas 
and may be used in the support of all four types of payloads. 

The design of the payloads should include as an integral part of the 
payload standardized equipment designed for supporting, hoisting, and other- 
wise handling th#* payload and which will interface and be used with standard- 
ized handling equipment. The general criteria for payload equipment design 
would include: 

a. Simplified equipment that will diiactly interface with the 
ground equipment without the requirement to assemble/ 
disassemble special adapters. 

b. Multiple use capability to allow the use of horizontal support 
fixtures having the capability of '-orienting the payload in 
pitch and roll and for Orbiter manipulator arm attachment. 

c. Compatibility with standardized hoisting slings for mating 
the payload horizontally and the handling gear used for mat- 
ing the payload vertically. 

The payload should be designed, the flow of prelaunch operations 
should be planned, and the facilities and equipment provided to minimize the 
number of times the payload is required to be moved. Among other advan- 
tages, this will reduce the potential for payload damage, eliminate require- 
ments for retesting, enhance the control and maintenance of contamination, 
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reduce the amount of support facilities and equipment required, and result 
in a significant reduction in the time for prelaunch operations. The criteria 
for reducing these moves include: 

d. The payload will include the design required for safety suf- 
ficient to permit all operations to be conducted in the payload 
processing facility, or other areas as applicable, without the 
payload being moved, without evacuating personnel, and w’hile 
other operations are being performed concurrently. 

e. Facilities should be selected or designed to accommodate the 
payload prelaunch operations within a single facility or com- 
plex of connecting facilities. The movement of the payload 
out-of-doors between facilities is to be particularly avoided 
wherever possible. The storage area for payloads should be 
in the same facility where the prelaunch processing is accom- 
plished to facilitate subsequent rapid minimum movement 
operations. Also located here should be the Tug and Orbiter 
simulators to avoid payload movement in the event that pay- 
load problem areas are discovered. It would be highly desir- 
able for the payload prelaunch processing facility to be con- 
tained within the same building as the Orbiter maintenance 
area, or in a connected adjoining building, to provide passage 
of the payloads without special transpo station considerations. 

£. The launch base standardized test, servicing, and other sup- 
port equipment should be designed and installed to facilitate 
operations with the several payloads being simultaneously 
processed in the prelaunch operation facility. Where instal- 
lations are not accomplished, the equipment should be 
designed to be highly mobile, with the capability of coming 
to and supporting the payloads in their respective locations. 

g. During all transportation and handling operations, the envi- 
ronment to which the payload is subjected should be monitored 
and recorded. This includes shock and vibration, temperature, 
relative humidity, and any other factors to which the payload 
is sensitive. The instrumentation and sensing equipment 
should be standardized in order that the data may be rapidly 
reviewed by standard equipment following any payload move- 
ment, The sensing equipment for the various functions may 
be a part of the design and installed : opriately on the pay- 
load where it may be used for other than ground transporta- 
tion and handling purposes. 
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6 . 


ORDNANCE CHECKOUT AND INSTALLATION 


The total time required for ordnance system circuit checkout, 
installation of ordnance, and the installation and removal of safe and arm- 
ing equipment is shown to require as much as two work shifts. Most of tne 
payloads incorporate ordnance and presently have the requirement for 
manned access into the Orbiter payload bay during operations at the launch 
pad. The undesirabU* requirement for post-mate access to the payload 
may be eliminated and the prelaunch op rations time reduced to a n axixnum 
of one shift by inrorporating the following guidelines: 

a. Currently the most common method of safing and arming 
pyrotechnic devices involves the use of in-flight jumpers 
(IFJs), one of which grounds the firing networks and pre- 
cludes unplanned activation of the ordnance. This is 
replaced before launch with a flight“configured jumper 
wnich will allow activation. These devices should be 
replaced by switches designed to be manually operated and 
with redundant interlock features. The safing /arming action 
may be manually accomplished on the ground or by means of 
a manipulator arm while in orbit. An alternate means could 

se remotely controlled electromechanical devices that would 
also possess the same fail-safe features. The design should 
also incorporate the capability for continuous status indica- 
tion and appropriate flight crew caution and warning displays. 
These features will also be of use during on-orbit payload 
letrieval operations. Several methods have been proposed 
(Kef. J-11) that appear to have merit and represent the 
dessred approach. 

b. Payloads should be designed for the installation of class A 
and B pyrotechnics prior to the receipt of the payload at the 
prelaunch processing facility. The design should include the 
provisions for appropriate access to the units following their 
installation for the purposes of possible removal /replacement 
of squibs and the installation of initiators prior to mating with 
the Orbiter. 

7. TUG AND ORBITER MATING, VERIFICATIONS, AND FLIGHT 
PREPARATIONS 

Tug mc.ving and interface checkout, preparations for mating with 
the Orbiter and interface verifications, non-hazardous servicing, closeout 
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flight preparations, and simulated flight tests are shown to presently total 
as much as 21 work shifts, with 12.5 shifts as a median. The time required 
for each of these operations is highly dependent on the particular payload, and 
it is difficult to differentiate and compare the individual operations to the 
study goal; however, it is significant that the totals are roughly comparable 
to the study goal total. The goal is to accomplish these operations for any 
payload in a total of no more than six days, with two da.ys allocated to the 
Tug operations, three days to the Orbiter siinulator, and one day for mating 
with the Orbiter. 

While the time shown as presently required is comparable to the 
goal, it is to be emphasized that the time for each goal operation *s the maxi- 
mum time allocated to be used as planned by a payload program. The oper- 
itions are not expected to normally utilize all of the allocated time and the 
planning will include slack time for trouble shooting, module replacement, 
and resolution of an^ problem areas that might be discovered during these 
operations. The planning of the utilization of this time is the prerogative 
of the payload program with respect to the number of shifts worked, the 
scope and depth of testing accomplished, the operations to be performed, 
and the slack time felt to be required. 

By utilizing uhe automated checkout /test equipment to conduct inter- 
face verifications and to repeat the pay lead status verification tests, and by 
conducting other operations concurrently, is expected that the Tug and 
Orbiter simulator operations will not require more than one day each. The 
subsequent mating of the payload to the Orbiter and verifications must be 
accomplished in approximately 12 hours, in accordance with Shuttle baseline 
requirements, and the additional time in the alio ution for this operation is 
sufficient to rccomplish the final closeout preparations, including the final 
cleaning of the payload to meet contamination control re rements. 

Many of the design guidelines previously stated will also be appli- 
cable to this phase of the payload operations. The payload design should 
include provisions for achieving the degree of cleanliness required 
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commensurate with mission requirement's. The requirements should be met 
by one or more of the following, and thr approach should be in the order 
listed: 

a. Design to tolerate the worst degree of contamination to be 
encountered from the factory through mission accomplish- 
ment* For example, exposed mechanisms should incorporate 
large clearances, loose tolerances, wipers, and seals. Solar 
power and thermal control surfaces should be sized to account 
for potential degradation from any contamination source. 

b. Design provisions for self-protection or control of contamina- 
tion. Examples include covers and/or gas purging, for opti- 
cal or other criticval surfaces, that may be actuated by remote 

time command signals. The use of deflectors, baffles, 
traps, and sacrificial surfaces should be implemented. The 
payload system may include plastic bags as appropriate for 
the entire payload or for portions of it. 

c. Design the payload to permit cleaning a to enhance the ease 
of achieving and maintaining the degree of cleanliness required. 
Examples include the selection of miaterials that do not generate 
and are resistant to the accumulation of contaminates. The 
materials should be compatible with cleaning solvents and the 
surfaces should oe designed for ease of cleaning and maintain 
ing cleanlinef^s . The design should eliminate natural traps, 
inside corners, orifices, obscured sirfaces, and areas that 
would impede the flow or puddle solvents during liquid flush- 
ing operations. 

d. Contamination control, monitoring, and test ec iipment will be 
furnished at the launch base for payload use. The basic equip- 
ment will consist of a large clean booth for each payload bay 

in the processing facility; a centralized air source controlled 
to payload requirements, vacuum, flushing, and other clean- 
ing equipment; clean-rc>>.m-tvpe clothing; monitoring; and 
testing instrumentation and services. Similar equipment and 
services will be provided for the payloads at all other areas 
as required. 

D. CONCLUSIONS 

The assumptions for the study, which cons . of some of the basic 
low cost payload design concepts, are more than simply guidelines. They 
are requirements, if the goal of 10- IZ days for payload prelaunch operations 
is to be achieved. Similarly, the guidelines developed from the examination 
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of the individual operations for time reduction are required, since most of 
them are outgrowths of the atjove mentioned assumptions /guidelines and show 
in more detail some of the ways in which the concepts may be implemented. 

By implementing the 6 assumptions /guidelines and th^ ' payload 
and operations guidelines develop 1 in the study, the goal of 10-12 days is 
possible, V/hile the summary of the time for the payload prelaunch op. ra- 
tions (Table J-2) indicates positive margins between the new nominal time 
requirements and the time allocated as available in the goa , this level is 
the lower limit of that which can be achieved. The mar ns ndicated will 
serve to acCv^mmodate increases in time occasioned by the n'^rrb jr of pay- 
loads in process at one time, the payload peculiars, and other variables to 
be encountered. 

The predicted launch rates for the initial part o5 the Shuttle program 
do not require that the payload processing meet the 10-12 day goal. Also, 
the goal is not expected to be achieved at the outset of the program, but thr 
capability will be designed into the system and it may be approached through 
an evolutionary process. The reduction in time will improve as the basic 
concepts are implemented and proved, the technical problems are resolved, 
and confidence is gained in the total approach. 

Some payloads will probably utilize ^\e 15-ft maximum diameter 
capability of the Orbiter payload bry and, due to size li: dtations during the 
factory-to-launch-site transportation, they will require some amount of 
assembly at the launch site. Since the prelaunch operations flow time is 
based on the receipt of a '^flight ready'’ oa.yload, it would appear that at 
least two days should be added to the flow to accommodate thor « p© /loads 
having this requi: ement. However, for a given launch base plan, this will 
either reduce the annual launch rate capability or require additional facili- 
ties and equipment to process at least rne more payload concurrently with 
the others being processed. The alternative is to provide a separate on-base 
facility for the assembly operations and deliver the payloads in a ’flight 
ready ’ condition to the payload processing facility. The lafcte^ facility is 
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Table J>2. Summary of Payload Operations Time 
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a highly specialized facility designed to provide a rapid uninterrupted flow of 
payloads to meet the launch rate requirements (10-15 day centers). The 
facility for payload assembly could be integrated with the facilities provided 
for payload refurbishment and preparations for payload return transportation 
to the factory or lead center. The alleviation of potential problems and 
scheduling effects, the shared use of equipment, and the ability to integrate 
the Sortie, or other large payload components coming to the launch base 
from different sources, are among the advantages to be gained by this 
method. It has been used in this study (as illustrated in Figure J-1) and is 
recommended for the Shuttle payload system. 

To meet the goal of 10-12 days for prelaunch processing operations, 
a i*iini:num of two 8-hr work shifts per day will be required. This is based 
on the new nominal times, which evolved from a large number of payloads, 
and variances in actual requirements will be encountered. It is again empha- 
sized that the goal times allocated for each operation exceed the requirements 
and may be used at the discretion of the payload program. 

All of the operati^'ns examined, and the associated guidelines devel- 
oped, are applicable to the expendable. Sortie, on-orbit maintainable, and 
the ground -refurbishable payloads with two possible exceptions involving the 
Sortie payload. The leak testing and propellant loading operation does not 
appear to be required at this time. However, it is expected that the presence 
of pressurized Sortie mo^iules and on-board pressure vessels will generate a 
requirement for similar operations and the general operations and design 
guidelines presented may be applied. In addition, there does not presently 
appear to be a requirement for ordnance operations. 

E. RECOMMENDATIONS 

The investigatioAiS for this study have revealed several areas which 
will have an impact on the time required to conduct the payload prelaunch 
operations, in addition to impacts on other elements of the system. Detailed 
studies are recommended for the following: 

1. The operations involved in handling radioactive thermoelectric 
generators (RTG) for payloads using this equipment as a power 
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source present problems for which there have been no really 
satisfactory solutions developed. The problems of thermally 
cooling the unitJ^ on the ground and protecting personnel from 
radioactive exposure in unmanned systems is difficult. Their 
use in the Shuttle may be expected to be more difficult, par- 
ticularly where the system will be required to be installed 
late in the flow and most probably on the launch stand. 

2. It is always highly desirable that a payload arrive at the launch 
base as a completely integrated ^’flight ready” unit and, since 
it is inevitable that some payloads will approach the maximum 
limits of 4.6-m diameter by 18. 3-m length, a considerable problem 
exists in how to transport the payload from the factory to the 
launch site. Diameter is particularly important, since it is 
usually the controlling factor in any of the modes of transpor- 
tation. Today the few outsized units are handled by special 

road permit, in Guppy-type aircraft, or by a barge waterway 
system, all of which are expensive. Presently, the C-5A 
cargo aircraft can handle 4. 1 m high x 5. 8 m wide x 37. 0 m 
long cargo and can exceed Orbiter payload weight limits. 

While the Guppy can handle the maximum payload diameter, 
there are critical weight/length limits and few aircraft are 
available. The requirements for the transportation of large 
size payloads will increase in the Shuttle era, and the solution 
to the problem could result in increased assembly /test oper- 
ations and facilities at the launch site. Since this problem 
area does not appear to have been addressed by any study, it 
is recommended that a detailed study of payload transporta- 
tion be initiated. Consideration should be given to all move- 
ment requirements, including the transportation from an 
alternate landing site to the required destination. A trade- 
off study should be conducted to determine the effects of one- 
piece vs many-piece payload designs with respect to cost 
effectiveness, considering all elements of the payload sys- 
tems including assembly, test, and on-orbit and refurbish- 
ment operations. 

3. The payload ground -refurbishment cycle needs to be studied 
in detail to resolve many problems /questions that have 
appeared. For example, should the refurbishment opera- 
tions be conducted at the launch site, the depot, or the fac- 
tory? If conducted at the laxinch site, will the test philosophy 
for the ”new** payloads be different from the original, with 
respect to thermal vacuum, acoustic, or other acceptance 
testing, or will facilities for this testing be required at the 
launch base ? 

4. The solution to the potential problems of compatibility of 
software developed for use at the factory and that to be used 
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at the launch base for testing purposes should be resolved. 
The use of universal test equipment stations located at the 
factory versus other methods should be examined for cost 
effectiveness. The impact of implementing the reduced test- 
ing concept at the launch base should be evaluated to deter- 
mine the extent to which software costs may be reduced. 

5. The on-orbit payload repair /maintenance should be studied in 
detail for each of the applicable payloads. The study should 
determine requirements, capabilities, and limitations and 
examine the impacts on grovmd testing and other objectives 
where compatible multiple purpose features may be incorpo- 
rated in the payload design. 
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APPENDIX K . LAUNCH SITE TESTING 


A, INTRODUCTION 

Present-day lavinch site testing is a repetition of the factory 
integrated system test (1ST) on most satellite programs. For some programs 
a complete set of factory AGE is shipped to the launch site, where it is set 
up to run the 1ST. On other programs, a complete set of AGE is installed 
permanently at the launch site where it is again used to run the IS'" After 
the satellite is delivered to the launch site and inspected visually for in- 
transit damage, an 1ST (perhaps abbreviated) is run to assure no electrical 
failures. The satellite is then mated to either the transtage or booster 
adapter fixture and made ready to mate to the booster. Usually an 1ST 
is run at this point to assure proper performance prior to mating with the 
booster. After being mated with the booster, placed on the launch pad, 
another 1ST is run as near as possible to the start of the countdown. This 
ends the test sequence at the launch site with the exception of anomalous 
conditions. It must be pointed out that the above r quence represents generally 
the procedure presently followed for the medium to large classes of satellites. 
There are some variances to the procedure described, but generally it is 
representative of most satellite programs. 

Upon inspection of the above sequence, it becomes obvious that 
the time the average satellite is actually in test (typically 30-50 hours) 
represents a small cost impact when compared to the cost of the AGE hardware, 
the expense of transporting the test and maintenance crews to the launch site, 
and the expense of retaining the test and maintenance crews at the launch site 
for extended periods. For a typical launch operation, approximately 20 to 40 
man months of effort are expended on operation and maintenance of the test 
equipment. If testing at the launch site requires an extra set of electrical 
AGE, test equipment, computer (not including software), communication and 
power equipment, and attitude control, it can add from 1 . 5 to 3. 0 million 
dollars to the project cost. 
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It can be seen that any effort to save cost by reducing the 
amount of testing would not reduce cost. Effort to develop simpler test 
equipment to be used exclusively at the launch site, would cost more than 
it would save. Hence, saving must come from the elimination of launch 
site testing, rather than reducing it. This approach assumes the Shuttle 
has the capability to perform relatively low-level payload tests. The 
probability of success is great enough to offset the risk involved in not 
performing a full integrated system test. Further, it must be shown how 
much a failure would cost versus the savings realized from the elimination 
of launch site testing. 

B. ASSUMPTIONS 

The capability to test the payload before deployment involves 
supplying power to the payload, communication with the payload, and data 
processing and display of test results. Each payload contractor will be 
required to supply software necessary to conduct the test from the Shuttle 
computer. 

C* POWER REQUIREMENTS 

If prelaunch and pre -orbit tests are to be conducted by the 
Shuttle on its payload, that payload must first be supplied by the Shuttle 
with sufficient power properly conditioned to suit each payload. This 
requirement could be made easier if a standard bus voltage could be agreed 
upon for all satellite contracts, since it is assumed this standard would 
also be adopted for the Shuttle power system. In any case, power, properly 
conditioned if necessary, will be assumed to be available from the Shuttle. 

D. COMMUNICATIONS REQUIREMENTS 

It will be assumed here that docking and undocking operations 
will be controlled from the Shuttle. This requires a communications link 
between the payload and the Shuttle for the purpose of commanding the 
attitude of those satellites to which the Shuttle will dock on orbit. A further 
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assumption is that a checkout of the payload will be required prior t^y 
injecting it into orbit. This again requires a link between the payload and 
the Shuttle, along with a computer to process the telemetry data. There are 
several methods for presenting the telemetry data to other systems, but 
for purposes of this document it will be assumed the Shuttle will contain a 
telemetry decommutator, a frame synchronizer, and a word formatter. 

From this equipment, data will be presented in a synchronized, parallel 
format with enough control lines to indicate when a new data word is present, 
when telemetry word one is present, and when the telemetry is synchronized 
(locked). The maximum data rate considered will be 256 kilobits, based on 
Reference K-1. 

E. DATA PROCESSING REQUIREMENTS 

In line with the preceding assumptions made for the commxmica- 
tions link, there will be n computer available on the Shuttle, This computer 
will be used to process downlink telemetry and uplink commands. For those 
payloads whose command link is interactive, the computer will provide the 
closed loop necessary to execute commands. 

This computer is assumed to be for general usage in the Shut ’e 
and one of its tasks will be processing telemetry for checking out the payload 
both on the launch pad and immediately prior to orbit injection. In or ’"^r that 
the computer handle the highest specified telemetry rate (256 kilobits) it 
must exhibit at least the following characteristics: 

16 bit word length (minimum) 

65, 536 words of executable memory 

10 million words of mass memory 

Execution rate of 400-500 kilo-instructions 
per second (KIPS) 

A computer meeting these minimum general requirements would 
b,. classified a mini-computer and would be capable of processing telemetry at 
the maximum rate, but very little interactive testing could be accomplished. 
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The general type of testing possible with a system of this nature is limited to 
activating a subsystem and checking its status. With the limited data process- 
ing capability described above, other systems could not be checked for 
spurious reactions and data trends could not be checked. These are generally 
classified "go, no go" low-level tests. 

F. DISPLAYS REQUIREMENTS 

For the low-level type testing assumed here, the display require- 
ments will be relatively slight. A Cathode Ray Tube (CRT) display with 
graphic capability, interactive keyboard, and light pen will be required. The 
CRT should be capable of displaying 40 to 50 lines of 80 characters each. This 
display must be available to the payload specialist who will act as test con- 
ductor. For the most part, the tests anticipated will be performed in pre- 
arranged groups, each of which will be started from the keyboard and the 
results (sometimes graphic) will be displayed on the CRT. An integral paper 
tape reader could be used advantageously to automatically run tests, but is not 
considered a requirement, 

G. ANALYSIS 

1, PRE-ORBITAL TEST REQUIREMENTS 

Although testing prior to orbit injection has been assumed, 
the level and intent of that testing has not been specified. The level of testing 
will be constrained by the capability of the data processing equipment, so the 
question becomes how much testing is required so that adequate data processing 
can be provided. 

The tests performed just prior to orbit injection need not be 
extensive for the expendable and refurbishable payloads because the detection 
of a failure is all that is required and not the isolation or diagnosis of that 
failure. Since these types of payload are not serviceable in space, nothing 
could be done for a failure even if it could be diagnosed. The important fact 
is that there has been a failure in the payload and it can be returned for 
grotind repair. 
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For the on-orbit maintainable payloads, it is unlikely that spare 
modules would be carried into orbit with the payloads because of volume 
limitations. Diagnostic testing, then, is not a requirement, since the infor- 
mation is of no use to the Shuttle mission even if it is available. Low-level 
status testing is all that is required so that each subsystem is checked to 
assure it has not failed. The mini-computer described in general terms in 
Section E is completely adequate for this type of testing. This also simplifies 
the software reqmred in the Shuttle computer, since complex cross checking 
and data trending is not required. 

2. BASELINE CONFIGURATION 

A baseline test configuration and four alternates to the baseline 
have been developed for comparison purposes. The baseline represents 
generally the present method of launch site testing for medium and large 
satellites. Each of the alternates will be considered for its impact, both 
technical and economic, to the baseline for the four missions. Note that for 
each of the five configurations it is assumed that the payload is delivered to 
the launch site fully tested and qualified for launch. No recommendations on 
factory testing are being put forth here and only the subject of launch site test- 
ing will be considered. Table K-1 is a matrix comparing each of the alternate 
c onfigur ations . 

The baseline, as stated previously, represents generally the 
present methods of laimch site testing and preparation for medium and large 
satellites. A complete set of factory AGE is supplied at the lavmch site for 
testing the satellite, hitegrated System Tests (1ST) are performed on the 
satellite in the Satellite Assembly Building prior to mating with tue booster 
and again (after mating to the booster) just prior to the start of the countdown 
on the latmch pad. No checkout capability is provided on the Shuttle. The 
satellite is launched, placed in orbit, and checked out from its ground station. 
In case of an anomaly, a decision would be made at this point on whether to 
re-dock the satellite to the Shuttle and return to earth, leave the satellite in 
orbit to be repaired on a subsequent mission, or discard the satellite as a 
failure. 
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Table K-J. Alternate Test Configurations 
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3 . ALTERNATE CONFIGURATIONS 

Alternate I 

This alternate represents the baseline with the addition of low- 
level checkout capability aboard the Shuttle. This requires the installation of 
a mini-computer aboard the Shuttle such as described in Section E. The 
sequence of operations is the same as for the baseline up to and including the 
1ST run just prior to the start of the countdown. At this point, the Shuttle 
would run a short (1-4 hours) status test on the satellite. After launch and 
prior to orbit injection, the Shuttle would repeat this test. If an anomaly is 
discovered at this point, the satellite could easily be returned to earth since 
it has not yet been undocked from the Shuttle* 

b. Alternate II 

This alternate is an extension of the baseline and Alternate I; 
Alternate II is Alternate I without the factory AGEl' Alternate II requires the 
mini-computer but does not require factory AGE? The 1ST runs prior to 
mating with the booster and prior to countdown under Alternate I ar^ 
eliminated. The only prelaunch test is the status test run prior antdown 

from the Shuttle. After launch, the operation is the same as dv ribed in 
Alternate I. 

c. Alternate III 

Alternate III is a major departure from the baseline in that it 
requires no factory AGE* at the launch site but requires a large computer in 
the Shuttle which can perform the same tests on the satellite as those 
performed by the factory AGE. The satellite is delivered to the launch site 
fully tested and qualified *or launch. It is then mated to the booster and a full 
1ST is run using the Shuttle computer. After laimch and before orbit injection, 
another 1ST (probably abbreviated) is run from the Shuttle. If an anomaly 
is discovered, the satellite can then be returned to earth. 


^ Electrical AGE 
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This alternate requires a rather large computer aboard the 
Shuttle in order to perform ISTs on the large satellites. This computer must 
be generally of the class of an IBM 370/145 (proposed by IBM for the DSP 
Phase II AGE) with approximately 512 K bytes (128 K words) of executable 
memory and 100 million bytes of mass memory. 

d. Alternate IV 

This alternate rep* sents the largest departure from present 
methods, in that it requires all satellites to include complete onboard check- 
out of each subsystem on the satellite. This would include small computers 
(Micro class) built into each subsystem which constantly run diagnostics on that 
subsystem and report status to a central computer for compilation. 

The satellite, as in all the other cases, would be delivered to 
the laxmeh site fully checked out and qualified f% ch. No testing would be 

performed as such, but after mating to the Shuttle the satellite would be 
connected hardline to the Shuttle computer, which vvould monitor th. perform- 
ance of the satellite subsystems through the onboard checkout units. This is 
equivalent to constant testing while the satellite is turned on; hence, it would 
satisfy the pre-orbital checkout requirements also. 

4. OPERATIONAL AND TECHNICAL IMPACTS 

The technical impact to present-day operations will vary with the 
alternate configuration. The baseline causes zero impact to present-day 
methods, since it represents the general methods now followed. 

Alternate I presents very little impact to present-day ope ration l., 
since the only requirement above the baseline is for a small computer cn the 
Shuttle wliich will have access to the telemetry de commutators. This computer 
will be available and only the interface with the decommutators must be added 
(assuming the telemetry receivers and decommutators are available). 

Additional software v/ould be required from the contractor to run the tests in 
the Shuttle computer. This software would be a functional subset of the soft- 
ware developed for the factory AGE computer, but since the likelihood of having 
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program-compatible computers is very slight, the software would be re- 
written, This software would be a requirement for any pre-orbital tests 
performed by the Shuttle also, so it cannot be completely attributed to pre- 
la\mch test reqmrements. 

Alternate II seemingly presents a large impact to prelaxinch test 
operations, but this impact is probably more emotional than technical. The 
question to be answered here is "How essential is a complete prelaunch 
test?" This alternate configuration eliminates the IST-type test and sub- 
stitutes a short status -type test just prior to launch. As in Alternate I, this 
presumes the availability of a computer which has a tel metry interface, so 
there really is no technical impact over that previously mentioned of needing 
the interface between the computer and the telemetry system. Operationally 
there is major impact, in that no ground testing as such is conducted using 
ground AGE. 

Alternate HI would have major impact, both operationally and 
technically. Since this alternate calls for a large computer aboard the Shuttle 
to run an IST-type test before launch, it also reqxiires test personnel on the 
Shuttle to conduct the tests. Technology has not advanced as yet to the point 
that such a large computer qualified for space is available, so it would also 
require a major advance in the state of the art of spaceborne computers. 

Alternate IV would have little impact to Shuttle operations or 
technology, but represents a major impact to the design and manufacture of 
satellites, would require the contracting agency to specify a type system 
which has not as yet been developed. Each contractor would be given the 
latitude of developing his own onboard checkout techniques and equipment bat 
each woxild be required to meet a standard interface. The state of micro- 
computers has not as yet been advanced to the degree necessary for this 
application, but there are several very small, space -qualified computers from 
which the technology cculd be developed. 
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5. 


ECONOMIC IMPACTS 


In order to bound any cost savings made possible by reduced scope 
of laxinch site testing, some costs must be attached to current test operations. 
These costs would be associated with the baseline configuration. The costs are 
developed for three classes of satellites: 

a. Large satellites launched singly and generally of the 
refurbishable or maintainable type, 

b. Medium size satellites launched in groups of two 
or more and likely to be of the expendable t^pe, 

c. Small payloads often of the back** class. 

The cost of test operations at the launch site is att:*ibuted ^o two major con- 
tributors. 

First, there is the cost of transporting the test crew and AGE 
maintenance personnel to the launch site and back to the factory and supporting 
them while they are at the launch site. This can involve from 5 to 15 men 
for up to two months. 

The second major contributor to latmch site costs is the cost of 
supplying a duplicate copy of the factory AGE ’Tor use at the launch site. The 
cost for factory AGE varies with the size, complexity, and type of satellite, but 
the major determinant of cost of the AGE'Us the data processing equipment. 
Generally, AGE costs range from $1 million to $3 million with a small number 
of programs of special nature being outside these limits on both sides (software 
cost not included). 

From this, the cost of launch site testing can be derived by adding 
a fixed cost (operations) to the cost of a set of factory AGE' amortized over the 
number of launches scheduled. For purposes of this document, the ntxmber of 
laxmehes will be assumed to be 5, For a specific mission, the launch site 
testing cost could be computed exactly, but average costs will be used here. An 
average of $5,000 per man month will be used for operations costs. 


Electrical AGE 
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Baseline Costs 


Large Satellites 


Operations, 30 man months 

150, 000 

AGE Hardware* 

600,000 

Total Cost Per Launch 

$750,000 

Medium Satellites 


Operations, 20 man months 

100, 000 

AGE Hardware * 

400, 000 

Total Cost Per Launch 

$500, 000 

Small Satellites 


Operations, 15 man months 

75, 000 

AGE Hardware * 

200, 000 

Total Cost Per Launch 

$275, 000 


b. Alternate 1 Cost 

Since Alternate I docs not eliminate any of the baseline testing, 
there will be no cost reduction. Instead, there will be a slight increase in the 
cost due to the added requirement of programming the mini-computer aboard 
the Shuttle, This cost is not considered significant, however, and for purposes 
of comparison Alternate 1 cost will be the same as baseline. 

c. Alternate H Cost 

Since Alternate II proposes eliminating launch site testing, using 

ijfc 

factory AGE, all the baseline costs would be saved. No added costs can be 
attributed to this alternate with the exception of the previously mentioned soft- 
ware cost for the Shuttle computer. The Shuttle software cost, again, is not 
being considered since it is relatively small and is associated with another 
requirement (pre -orbital tests). 

♦ Electrical AGE 
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The percentage of launch cost which can be saved using this 

alternate is: 

Large Satellites 7,1% 

Medium Satellites 9.5% 

Small Satellites 13.1% 

This assumes a SJhuttle launch cost of $10.5 million and the 
following additional assumptions: 

(1) Single large satellites are launched with one medium 
satellite. 

(2) Medium satellites are launched in groups of two. 

(3) Small satellites are either "piggy back" with other 
missions or launched in effective groups of five. 

d. Alternate HI Cost 

Alternate IH requires no launch site testing using the factory AGE, 
but it requires an equivalent to the 1ST to be conducted from the Shuttle using 
the Shuttle computer. The costs associated with duplicating the AGE will be 
saved, but software to run the test in the Shuttle computer wdll be required. 

This software is ftmctionally identical to that already developed for the factory 
AGE, but it must be rewritten for use in a different co^ .uter (the Shuttle com- 
puter), It is assumed this software will cost half as mu^h as a set of factory 
AGE, so half the hardware cost will be saved. Since no AGE'" maintenance 
personnel are required, and it can be assumed that the Shuttle equipment will be 
more compact and easier to operate, the operations cost will be approximately 
half those for the baseline. Therefore, this alternate saves approximately half 
the baseline cost but reqmres a very large (and expensive) computer on the 
Shuttle. 

e. Alternate IV Cost 

Since this alternate conducts no ground test using the factory AGEJ 
all the costs of the baseline are saved. There would, however, be added cost 

♦ Electrical AGE 
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on the satellite of designing and installing the onboard checkout devices. 
Probably the net effect on the smaller satellites would be to increase project 
costs, but it would be impossible to quantify these costs at this time. 

H. RESULTS AND INTERPRETATION 

Of the configurations, the baseline and Alternate I offer the 
lowest risk and highest confidence of successful operation. The baseline is 
representative of current operations and has been developed from many years 
of experience. Alternate I includes all of the baseline and adds the further 
dimension of conducting a status -type test from the Shuttle. The advantage of 
these configurations is that they require little new procedural or technological 
development. The main disadvantage of these alternates is they are relatively 
expensive, although the cost of launch site testing docs not represent a 
significant portion of the total latmch cost. 

Alternate II offers the greatest cost savings but presents some 
element of risk in that no detail testing is performed after the satellite leaves 
the factory \mtil it is on orbit. This requires a high confidence in *he satellite 
in order to launch without a detailed test at the launch site. A degree of con- 
fidence can, of course, be gained by running the low-level status tests from the 
Shuttle prior to launch* 

Alternate HI reduces the risk, but requires a large computer 
aboard the Shuttle. This allows the detailed tests to be run before launch, but 
they are conducted from the Shuttle without the need of factory AGE. The dis- 
advantages are that a set of extensive software must be developed for the Shuttle 
computer and that such a computer is not available using present technology. 

The size of the computer is the real problem because there is no demand for 
data processing equipment of this nature. Thus, it woiild require special 
development which would make it prohibitively expensive. 

Alternate IV, while offering great advantages in all aspects of 
testing, seems somewhat utopian at this time. If each of the subsystems of a 
satellite could be made to completely test itself, this capability could be used 
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even down to the assembly line level. This approach would reqxiirc a great 
deal of research and, even if feasible, it would have to be required for all 
satellites so that standardization could be effected. Until these subsystems 
become widespread, they would also be very expensive# 

I# CONCLUSIONS 

It appears, without extensive study of the subject, that Alternates 
III and IV are inadvisable at this time# If the state of the art of either large 
spaceborne data processing systems or self-contained diagnostic equipment 
were advanced significantly in the near future, these could become attractive# 
For the present, they are unattainable# 

The baseline does not include a capability which is required; 
namely, the ability to perform a satellite checkout prior to orbit injection# 
There are methods of circumventing this restriction (e#g#, relaying the 
satellite telemetry to the ground for checkout)^ but the requirement is not 
difficult to meet using a computer already installed on the Shuttle# There is 
also the need for command and control contact between Sh\xttle and satellite 
whose requirements overlap those of testing# 

The choice, at this time, appears to be between Alternates I 
and n, making it a choice between testing for higher confidence or accepting a 
greater risk for cost saving# The smaller satellites appear to offer a good 
trade-off between these factors requiring relatively low confidence factors, but 
the large satellites whose failure would abort the complete mission may not be 
a good vehicle for this cost savings# 

J# RECOMMENDATIONS 

Alternate II is recommended as the optimum trade-off between 
cost savings and risk for satellites which are not launched singly# A further 
study of the incidence of laimch site failures and the level of testing possible 
with Shuttle equipment is suggested to make a final selection of the mode of 
operation# Further study should also pursue the questions of spaceborne data 
processing equipment and the viability of requiring self-contained diagnostic 
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equipment. The availability of either Alternate HI or Alternate IV could 
change the recommendations. 

Further study should be pursued on aspects of testing other than 
at the launch site. The modularity of the repairable and refurbishable satel- 
lites coxild yield some cost savings if the test equipment could also be 
standardized. Test sets such as those developed for integrated circxiit testing 
could present opportunities for reducing both assembly line testing and inte- 
gration testing. These test sets would include a computer and be programmable 
over a wide range of subsystems and could be integrated into a larger test set 
for system testing. 

The use of Universal Test Eqxiipment (UTE) at both the factory 
and the launch site should also be studied to determine its feasibility. The 
greatest problem in using UTE is designing it to accept the largest, most 
complex satellite and yet be cost effective on the smaller satellites. Wide 
usage of UTE would be required in order to make it cost effective^ and if 
the software required for its use is more costly than developing special AGE, 
then the UTE may not be economically feasible. 
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APPENDIX L. DESIGN 


Analyses have been conducted to identify alternative approaches to 
the modularization of payloads^ to select preferred approaches v^ere 
possible, and to identify the considerations or tradeoffs necessary to arrive 
at practical solutions to the many problems that will be encountered. The 
analyses have been conducted by establishing a conceptual design for each 
of two diverse types of payloads which are used as baseline or reference 
designs. The Defense Support Program (DSP) spacecraft was used to 
represent a typical synchronous orbit payload launched and serviced on 
orbit by the Tug. Most of the conceptual design effort on DSP is presented 
in Reference L-1. For completeness* the work is included herein when 
appropriate. The Large Space Telescope (LST) was used as a baseline 
vehicle representative of relatively large* low--earth-orbit (LEO)* Orbiter- 
launched and serviced payloads. A conceptual design of a modularized Earth 
Observatory Satellite (EOS) developed under NASA Study 2.6 was also 
considered for reference purposes. 

The analysis of the subject Serviceable Payload Modularization is 
presented in sections under the following subject heading..: 

A. Replaceable Module /Payload /Service Module Compatibility 

B. Replaceable Module Thermal Control 

C. Replaceable Module /Payload Fluid Interfaces 

D. Replaceable Module /Payload Electrical Interface 

E. Non- replaceable Equipment in an On-Orbit Maintainable 
Payload 

F. Module Removal/Replacement Using Manipulator 

G. Module Backup - Handling Provisions 

H. Recommended Tradeoff Studies 

It was assumed that the design problems encountered with the DSP* LST* 
and EOS would be typical of those encountered in the design of any payload 
for on-orbit maintenance* 
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A. REPLACEABLE MODULE/PAYLOAD/SERVICE MODULE 
dOMPATIBILITY 

The design of a payload for on-orbit servicing should not be 
divorced from consideration of the type of motion selected to transfer 
replaceable modules to and from the payload, the design of the service 
module, and the design of the modules themselves. 

The transfer motion selected should be one which will result in 
simple, reliable, lightweight mechanisms to accomplish the transfer and at 
the same time result in a spacecraft configuration which is compatible 
with the requirements of the mission. The service module design should, 
of course, be compatible with the transfer motion selected and the space- 
craft configuration. 

To help illustrate the design process for a space serviceable 
spacecraft and its servicing equipment, a discussion of the design of the 
Space Serviceable Defense Support Program ( >DSPy^ spacecraft is presented 
in Reference L-1. 

The SSDSP was assumed to be typical of spacecraft in geosynchronous 
orbit. Furthermore, it was assximed that the general nature of design 
problems encountered with the SSDSP design would be typical of those 
encountered in the design of any payload (low-earth to geosynchronous 
orbit) for on-orbit servicing. Hard-docking between the Tug and the space- 
craft was assumed in all cases to accomplish on-orbit servicing. 

The study presented in Reference L-1 concluded that the design 
of a spacecraft for on-orbit servicing should not be divorced from the 
design of the service module, the design of the modules, and consideration 
of the type of motions required to achieve transfer of the modules to and 
from the spacecraft. 

The transfer motions selected should result in the design of a 
lightweight, simple mechanism to achieve those motions. 

The shape of the spacecraft and the service module should be 
compatible with the transfer motions. 

^ This program is also referred to as the Shuttle -Launched Defense Support 
Program (SLDSP). 
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The module design should allow for simplicity of removal/insertion, 
alignment and locking in place. Furthermore, it should be a basic design 
common to all modules in the spacecraft and be able to meet the packaging 
requirements of each of the modularized subsystems. 

B. REPLACEABLE MODULE THERMAL CONTROL 

Design studies of the Defense Support Program (DSP), Earth 
Observatory Satellite (EOS), and the Large Space Telescope (LST) space- 
craft were configured for on-orbit servicing via a remote servicing module 
have indicated that the thermal control system design of the individual 
modules should be self-contained. 

Ground refurbishable or expendable spacecraft which have no 
replaceable modules that must be automatically positioned and therefore 
no movable module /spacecraft interface do not require self-contained 
thermal control systems for each subsystem or grouping of subsystems. 

The three payloads (DSP, EOS, and LST) chosen for the space 
serviceable design studies were assumed to be typical of spacecraft in 
geosynchronous and low-earth orbit. It was assumed that the design 
problems encountered with these spacecraft would be typical of those en- 
countered in the design of any spacecraft for on-orbit servicing. 

The design studies performed and reported on in Section 4 of 
Volume II and Section 3 of Volume III were performed for the on-orbit 
maintainable type of payloads. In these design studies, an interface 
between the module and the spacecraft which would be typical of that 
required for an on-orbit serviceable spacecraft was designed. This inter- 
face design is shown in Figure L- 1 . When the module is locked into 
position on the spacecraft, it contacts the spacecraft at three points only. 
These three points are indicated by the arrows on Figure L-1. The main 
feature of this interface is that it is simple and has a minimum of contact 
points. However, the concept of minimum contact points is not compatible 
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with the transfer of heat across the interface through conduction. Minimal 
contact between the module and the spacecraft does not provide good con- 
ductive heat transfer* therefore* it is desirable to have a self-contained 

thermal control system. In addition, conductive heat transfer across 
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joints quite often requires high clamping pressures (15-20 x 10 N/m } 
and very smooth surface fini shes in order to minimize thermal resistance. 
High clamping pressures are difficult to achieve with a joint designed to be 
mated and demated in space. Also, the pcssibii ty of cold welding the 
joint could be a problem. 

Because typical sensors for spacec-^ uHe often i.ulude those 
v^hich operate in the IR region, cooling to ten...cAatures in the neighbor- 
hood of 90^K - 120^K could be required. For example, following is a 
partial list of IR sensors for the EOS mission, along with their required 
detector operating temperatures: 

1* Thematic Mapper (7 Detectors) 290^K 

290^K 
290°K 
290°K 
120°K 
120 K 
90°K 

2. Cloud Physics Radiometer (InAs Detec tors) 120°K 

As can be seen, at least four of the detectors must operate at 
IZO^K or lower (Reference L-2). Another example is the focal plane 
detector array for the DSP which also must operate at relati’"ciy low 
temperatures. Achievement of operating temperatures in these ranges 
requires either the use of second surface mirror radiators, solid cryogen 
refrigeration or some type of active refrigeration system. Furthermore, 
to transfer the heat away from the detectors to the refrigeration system 
or radiators, some form of conduction path, such as a conduction bar or 
heat pipe is required. In incorporating these concepts into a space 
serviceable spacecraft design, two basic approaches cm be considered: 
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a. The cooling system can be separated from /etectors 
such that a joint capable of being demated :iated at 

the module /spacecraft interface is required ’ the conduction 
path between the detectors and cooling oyste^r, or 

b. The e cire system can be seH-contained within the detector 
module. 

The conduction of heat across a joint as in choice (a) above requires 
very smooth surface nishes and high clamping pressures to minimize the 
&T across that joint. Experience with the second surface mirror radiator/ 
conduction bar cooling system for the DSP has shown that, even with a joint 
br'^ween the conduction bar and radiator which has been assembled on the 
ground and is not intended to be separated, it is difficult to achieve good 
thermal conductivity across that joint. The DSP utilizes a magnesiiun 
conduction bar joined to a magnesium radiator frame to which second surface 
mirrors are mounted. The two are joined via four 10-32 screws. Heat 
is conducted away from the detectors, through the conduction bar, across 
the joint and through the radiator to space. Flight experience with the DSP 
had shown that the detectors we ve not being maintained at their operating 
temperatures due to a reduction in preload of the screws holding the radia- 
tors to the conduction bar. The solution to the problem was to specify very 
smooth surface finishes (10 microinch RMS) and a clamping pressure of 
20 X 10^ N/m minimum. The clamping pressure was monitored during 
assembly via strain gages mounted on the bolts. Other methods that can be 
used for achieving good thermal conductivity across joints include the use of 
indium foil or thermal grease combined with high joint ^'^essuree. Figure L-2 
shows the variation of contact thermal resistivity with joint pressure for a 
variety of materials and surface finishes. 

The foregoing discussion shows some Df the requirements for 
achieving a good thermal conducting joint. Attempts to achieve good con- 
ductivity with a joint which must also be mated and demated in space would 
result in difficult design problems. The high clamping pressures and 




very smooth surfaces required to achieve good heat transfer are, on the 
other hand, conducive to cold welding in a vacuum. The mechanics of a 
mechanism which would provide high clamping pressures, even if the 
cold welding problem could be solved, would be very complicated. 

For the above reasons, it is felt that the thermal control system 
for each module should be self-contained (choice b). The design of a 
self-contained thermal control system for each module can be readily 
achieved. For the SSOSP spacecraft, t!.e thermal control system design 
is reported on in Reference L-1, Each module has either a passive 
system such as multilayer blankets or mylar or second surface mirrors 
which act as passive radiators, or active control such as heaters. Heat 
is transferred within the module via conduction bars or plates or heat 
pipes. Although the SSDSP did not utilize active cooling such as solid 
cryogens or Vuilleumier refrigerators, this could be readily accomplished. 
The replaceable feature of the modular concept would make active cooling, 
where required, an attractive concept. 

The thermal control system for the EOS is quite similar to that 
of the SSDSP, except that the many IR sensors on board the EOS require 
some form of active cooling to achieve the 90^K - 120^K detector tempera- 
tures. Here again, the replaceable feature of the module makes it 
attractive to consider active cooling. 

C. REPLACEABLE MODULE/ PAYLOAD FLUID INTERFACES 

Fluid interfaces between a module and the payload which require 
demating and mating each time a module is replaced should be avoided in 
the design of a space servic.^able spacecraft by making all fluid systems 
self-contained within a module. 

Design studies (Section 4 of Volume II and Section 3 of Volume III) 
in which the Defense Support Program (DSP), Earth Observatory Satellite 
(EOS), and the Large Space Telescope (LST) were configured for on-orbit 
servicing via a remote service module have indicated that it is desirable 
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to maintain the interface between the module and the payload or space- 
craft as simple as possible. The interface should consist only of the 
mechanical interface required to align the module to the spacecraft and 
carry flight loads, and the electrical interface required for power and 
data transmission. Addition of a fluid interface would complicate the 
module /spacecraft process by rev';uiring at least one extra joint which 
would have to be aligned prior to the final operation of locking the module 
to the spacecraft or require a mechanism which would align and lock the 
mating halves of the connector after locking the module to the spacecraft. 

Ground- refurbishable or expendable spacecraft which have no 
replaceable modules could be designed to have separable connectors, 
although generally, it is recommended that brazed connections be used 
whenever possible. 

The difficulties involved with mating and demating fluid connectors 
remotely 'n space are influenced by the type of fluids required to be trans- 
ferred. The configuration of the spacecraft and the type of on-board sub- 
systems will determine the fluids used. These fluids could range from 
gases such as helium or nitrogen to room temperature liquids such as 
hydrazine to cryogenics such as The launch environment, orbit, 

orbital maneuvering requirements and reentry environment determine 
the conditions under which these fluids must operate. A partial list of 
some possible subsystem operating environments is shown in Table L>-1. 

As can be seen from this list, the operating environments could range 
from cryogenic temperatures to temperatures well above room temperature, 
depending upon the fluids used. Thus, if we consider the use of mateable/ 
demateable connectors, the problem becomes one of designing connectors 
capable of transferring the above-mentioned types of fluids with negligible 
leakage over a wide range of temperatures and pressures. In addition, 
the mechanisms for achieving the connection remotely in space must be 
designed. Once the connection is made, a method of checking for leaks 
must be employed. 
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Table L-1. Possible Subsystem Operating Environments 
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Reference L-3 reports on the experience gained in 'he devilopment 
of over 1, 300 separable (but not remotely mateable/demateable) connectors 
for the Saturn IV stage. The problems encountered over a long development 
program were manifold and complex. After installation of the coi"' 'c'crs 
by highly trained and skilled personnel, many leaks were uncovered at the 
system checkout level. Table L-2, taken from Reference Xj-4, ;iows the 
number of leaks founa at the system check level. 

Table L-2. 


c/o 

— 
Approx. Number of 
Leaks 

Approx. Number of 
Connections 

1 

40 

500 

2 

80 

800 

3 

Not Available 

900 

4 

110 

900 

5 

70 

1,000 

6 

70 

1, 100 

7 

90 

1, 200 

8 

60 

1, 300 


It can be seen that, at times, over 10 percent of the connectors showed 
leakage, even after being assembled with great care in clean conditions 
by trained personnel. It is reasonable to assume that the potential per- 
centage of leaks encountered in a system designed for remote coupling 
in space would be at least this great and probably greater. 

To detect leaks, however, would require on-board leak check 
equipment. In all probability, more than one type of leak detection system 
would be required. In a discussion of methods of static-leak detection in 
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Reference L-5, it is pointed out that no single method is used because 
none is completely universal. The most suitable method for a given situa- 
tion depends on a number of criteria: 

1. Fluid used for pressurization 

2. Magnitude of the anticipated leakage 

3. Configuration oi the hardware to be checked 

4. Environment of the leak; i.e.. temperatures and pressures 
involved 

5. Accuracy required 

6. Whether it must be quantitative or qualitative 

7. Time and facilities available for this effort. 

The methods of leak detection used by Rocketdyne are shown in Table L-3 
which is taken from Reference L-5. 

Table L-3. 


HrtWi 

PrACticat 
l««tr laaii 

UtwH iMaiiUtiw Oi»UUiiw >cfA»r 

Cafiwi Gr^uaO Plij(X( 

PtrtltnMrai CXvcIiMii CWckant Tati T«at 


1 


X 



X 




IVrsmirr l«cM^ 

X 

X 

X 

10-2 


X 





X 


X 

10*1 


X 




Jh»Ua»i«r 

X 

X 


lt-> 

X 

X X 




N|MpcirMBi*r 

X 

X 


10-10 

X 

X 




nigkt 

X 

X 


lo-a 



X 

X 


IhillSM 

X 

X 


10-1 



X 

X 


lf«Wr 

i X 

X 


10-3 

X 

X 

X 

X 


Risr^i Pkii|<4imKa 

X 


X 

10-2 



X 

X 












n«wur 

X 

X 


1 

X 


X 

X 

X 


It was also noted in Reference L-5, that the Hastings- Raydist Flowmeter, 
the only instrument listed for in-flight leak detection is "a proposed, but 
not a proven method". 
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Reported on in Reference L-6 are a number of sensors capable 
of detecting gas leaks* They are divided into three groups: hydrogen 
sensorst oxygen sensors, and non-specific sensing methods* The state- 
of-the-art, as well as the commercial availability of the sensors \n these 
three categories, is discussed in Reference L-6* The conclusions of the 
study point out that ''Many methods and many instruments are available 
for the detection and location of leaks* No one instrument or method is 
ideal for any particular application in the space industry". It is further 
stated that: "It appears that further research is in order to enhance the 
state of the art in the leak detection area. The ideal system is yet to 
come 

It appears that incorporating a leak detection system in a space 
serviceable payload would be a very complicated and difficult task due 
to the lack of availability of a flight qualified leak detection system capable 
of detecting leakage of a wide range of liquids and gases* 

To date, no fluid couplings exist which can be mated and demated 
in space and still provide zero leakage service over the expected wide 
range of fluids and operating environments. There are available some 
quick disconnect couplings such as a coupling assembly used for RP-1 rocket 
fuel transfer^ manufactured by Snap- Tite, Inc* (Ref. L-3). However, this 
is intended for ground use, and, as noted in Reference L-6, it is very 
difficult to assemble. There are also others intended for use with hydraulic 
fluids or air but none of these are for space use and furthermore there are 
none which are designed for unamnned operation* 

In the design studies in which space- serviceable spacecraft were 
configured for the DSP, LST, and EOSmissons, it was shown that all 
subsystems requiring fluids could be designed such that they were self- 
contained within a module. Thus, no fluid interfaces were required. This 
approach is felt to be a much more reliable, cost-effective, and simpler 
solution than that of trying to design and develop a fluid coupling capable 
of in- space connection. 
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The types of subsystems which require fluid couplings* for example 
attitude control propulsion, refrigeration systems* etc. are of such a 
nature that they can be designed to be contained within a single module. 

If, for example, in the case of a propulsion system, more volume is re- 
quired for expendables in order to increase the time between expendables 
replacement or to provide enough expendables for the life of the mission, 
then one could consider a hybrid system in which extra tanks are mounted 
on a non- replaceable portion of the payload and connected to the module 
via plumbing and a joint which could be cut and sealed in a one-time-only 
operation. After the fuel in the tanks on the module is exhausted* the 
tanks would be sealed off with a ci tter/sealer and the tanks on the space- 
craft would be tied into the system through an existing factory-installed 
plumbing system. ‘ The valves, thrusters, and control electronics would 
be designed with enough reliability to last the life of the payload. In the 
event of a failure of a valve or thruster or other component on the module 
which would require module replacement, the module could be replaced 
with one which would operate only as a self-contained system that would 
then be replaced at regular intervals as expendables were exhausted. To 
replace the module would require that the non- replaceable tank on the 
payload first be sealed off, thus breaking the connection between the module 
and the spacecraft mounted tank. The remaining fuel in the payload tank 
would no longer be available for use. 

D. REPLACEABLE MODULE/PAYLOAD ELECTRICAL. INTERFACE 

Design studies in which the DSP, EOS, and the LST were con- 
figured for on-orbit servicing via a remote service module have utilized 
an electrical interface consisting of a single 1. 5 in. diameter pin. This 
pin, shown in Figure L-1* serves three purposes: it provides mechanical 
alignment between the module and the spacecraft and carries flight loads, 
it transmits data and commands through a single coaxial connector in the 
center of the pin, and it provides a DC power and ground connection to 
each module via the two terminals on the shoulder of the pin. 
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While the design studies performed and reported used this single 
pin concept, it is not immediately obvious that a single pin connector is 
the most advantageous design to utilize for the module /payload electrical 
inte rface. 

Ground- refurbishable or expendable spacecraft which have no 
replaceable modules would not need to utilize an electrical interface con- 
cept such as the one described herein* Conventional flight-quality, multi-pin, 
separable connectors could be used as is common practice on existing 
expendable spacecraft design. 

Design studies of payloads configured for on-orbit servicing re- 
sulted in definition of an electrical interface between the module and the 
spacecraft which might be typical of that required for the in-orbit main- 
tainable type of payload. This interface is shown in Figure L-1. The 
primary feature of the module /spacec raft interface shown in the figure is 
that it relies on only one mechanical motion to lock the module to the 
s{>acecraft which also establishes the electrical and data interface. 

The concept of using a data bus for data transmission allowed 
the use of a single coaxial connector for data transmission. Because the 
pin had to be large enough to help carry flight loads, it was also large 
enough to carry electrical power transmission wires (separate DC power 
and ground wires) in addition to the coaxial cable for data transmission* 
However, to accomplish data transmission to and from a module via a 
single coaxial connector required a considerable amount of data bus 
equipment in each module. In the study reported on in Section 3 of Volume 
III, no tradeoff studies were performed in which overall payload complexity, 
complexity of the module /spacec raft interfaces, and complexity of the data 
bus were compared with the number of electrical connections chosen for 
data transmission. The number of electrical connections normally made 
in an expendable payload would bound one end of a tradeoff study and the 
single pin concept used in the SSDSP, EOS, and LST studies would bound 
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the other end. It may be possible to reduce the complexity of the data 
bus system for those payloads already studied by increasing the number 
of pin connections at the module /spacecraft interface. In addition^ the 
number of pins is a function of the quantity of modules the payload contains, 
the manner in which the subsystems are divided between these modules, 
and the amount of redundancy required. 

Assuming the number of electrical connections at the interface 
are increased over the single connector design, it is conceivable that 
the same single connector concept could be designed to house more than 
one coaxial connector merely by changing its diameter or its shape; possible 
pin configurations are shown in Figure L-3. These concepts still allow 
use of a single pin to locate, align, and lock a module in place, in addition 
to providing electrical power all with movement of a single pin only. 
However, these concepts contain more than one coaxial connector for data 
transmission. 

Addition of another pin would still allow the same type of locking 
motion, actuated by the service module mechanism, to lock the module in 
place and to provide the power and data transmission. However, the 
problem of providing close tolerances on the dimensions between the pin 
holes and the pins from module-to-module and payload- to-payload is intro- 
duced. This mismatch in spacing between pins could result in poor contact 
between the module and spacecraft, misalignment f the module relative to 
the spacecraft, excess strain on the mating parts, or ''t the worst, result 
in failure to achieve a mate. In any case, a dimensional tolerance problem 
is introduced with the addition of an extra pin which doesn't exist with a 
single pin. 

Another possibility would be the use of a separate multi-pin 
connector, contained in the module, which would be mated to the space- 
craft after mating of the module to the spacecraft. This would require a 
separate mechanism to achieve connector mate. This mechanism would 
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D1A« INCREASE ALLOWS INCREASE 
IN NUMBER OF PINS 





Figure L-3. Modification of Single Pin to Provide 
for Multiple Electrical Contacts 
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have to be operated remotely from the service module since the payload 
is shutdown during the servicing operation. A design could be developed, 
but at the expense of additional complication, weight and a reduction in 
reliability. 

In each of the above discussions, use of a sliding type of connector 
for data transmission has been assumed. This is necessary in order to 
achieve a clean contact. The sliding action of the pin in its receptacle 
produces a self-cleaning action to assure clean contact. Butt-type or 
button contacts maintained by spring action are not satisfactory for data 
transmission due to the possibility of contamination on the contacts. Unlike 
electrical power transmission, there is not enough current transmitted 
across the data contact to cause arcing and thus self-cleaning. Therefore, 
a sliding type of data connector is required. 

E. NON-REPLACEABLE EQUIPMENT IN AN ON-ORBIT MAINTAINABLE 

payl6ad~ 

In designing a payload for on-orbit servicing, it is not necessarily 
desirable to require that all subsystems or components be replaceable. 
Consideration of the mission life, orbital parameters, type of sensors and 
equipment, operating requirements of the various subsystems, and packaging 
requirements for the payload under study may indicate that certain of the 
subsystems should be designed for the life of the mission and therefore 
are not to be replaceable. 

The most obvious example is the basic spacecraft structure which 
should be designed for non- replacement. There are no wear out items in 
the structure and it can easily be designed to w'ithstand the flight loads. 

The largest flight load factor for the Shuttle is 3. 3 g*s and is 6 to 7, 5 g*s 
for expendable booster load factors. These load factors do not impose 
severe loading conditions on the structure. 

Solar arrays are another item which should be considered for 
permanent installation. For a typical serviceable payload mission life 


L-20 



of ten years, it has been shown that solar arrays for spacecraft in orbits 
ranging from low-earth to geosynchronous (Ref. L-1) can be sized to 
operate satisfactorily for the entire ten-year period. From a design stand- 
point, increased flexibility can be gained by using a solar array which does 
not have to be replaced. The array no longer has to be packaged within the 
module itself which permits greater latitude in selection of the type of 
array to be used, i.e., roll out, rigid panel, etc. Replacement of the 
solar array drives, if an oriented array is used, can still be accomplished 
with a non- replaceable array by means of a technique such as that shown 
in Figure L-4. 

Antennas quite often require special viewing angles or are so large 
that they present design problems if they are required to be replaced. Con- 
sideration should be given to mounting the antenna to the spacecraft structure, 
and mounting only the associated electronics within the module. The 
problems which may arise with this approach include the following: 

1. If *~he antenna is steerable, then the drives will probably 
have to be replaced; methods for replacing drives, but not 
the antenna, would have to be developed. 

2. High operating frequencies (in the RF range) require 
waveguide connections between the antenna feeds and 
electronics. If the operating frequency is high (for 
example, 60 GHz), then the pointing accuracy requirements 
may place such strict anti- backlash requirements on the 
drive as to preclude the possibility of designing a 
replaceable drive. Two problems could arise if the antenna 
is not replaceable and the high frequency electronics are in 
the module: 

a. The waveguides must have a separable joint which 
must be mated to high tolerances (on the order of 
± 0.0005 in. for a 60 GHz operating frequency)* 

b. Power losses increase as the length of the waveguide 
increases. This may require that the electronics 

be mounted directly on the back of the antenna and, 
if the antenna is small enough, packaging of the 
entire assembly as a module for removal/ replacement. 
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Figure L-4, Replaceable Drive 



Optical systems are another candidate for non^ replacement. Quite 
often ^he optics are very large, as is the case svith the LST and DSP sat- 
elites. With the exception of drives and focal plane detectors, optical 
systems can be designed to last for the life of the mission. However, 
other problems could be introduced. For example, if focal plane detectors 
are subject to degradation or failure and must be replaced, th*^ i some type 
of focus detection and aijustment system would be required t orient the 
new focal plane detector. 

F. MODULE REMOVAL/RFFLACEMENT USING MANIPULATOR 

One of the tasks of the operator of the Shuttle attached manipulator 
system (AMS) is to effect the removal of a module of an on-orbit main- 
tainable satellite and to replace this (failed) module wth a new moaule 
of the same type by means of the manipulator. This task niay be accomplished 
more simply and effectively if the module system (the module and its grasp- 
ing points, handles, latches, etc.) is designed minimize the number of 
different movements required of the AMS and its operator. 

It is not anticipated that the withdrawal/ replacement of a module 
will represent a simple task. Any design features that can be incorporated 
into the system that will facilitate the operation will simplify the task of 
the manipulator operator and speed the satellite refurbishment cycle. This 
will be particularly important in the case of a payload containing a large 
number of modules where equipment is being replaced down to the ’^black 
bor” level. 

The time required to repair/refurbish the module complement 
of a low-earth“orbit, on-orbit maintainable satellite can be reduced if the 
modules are designed so as to minimize the number of motions required 
of the attached manipulator system. 

A design analysis that is presented in Section 3 of Volume III was 
made in the form of a preliminary design (layout drawing) to identify a 


L-23 


feafjible means of designing a space replaceable module, i.e., satellite 
module that could be readily removed and replaced by means of the 
operator-controlled attached manipulator system. 

Several perturbations were made to the drawing. One design 
(Figure L-5) was made wherein the latch handles and module carrying 
point were designed in the form of simple rods. The latch release handles 
were located symmetrically on either side of the central grasping (carrying) 
point. In order to remove a module, this design would require the manipu- 
lator to first release the first (one) latch via a grasp, release, and pull 
operation. Then it would be necessary to translate the end effector of the 
manipulator to the opposite side of the front face of the module and repeat 
the above operation at the second latch. Finally, a translation could then 
be required back to the central grasping (carrying) point to grasp the 
module handle and withdraw the module from its structural housing. A 
complete reversal of these operations would be required to insert and 
latch the replacement module. 

Further examination of the design led to the identification of a 
means whereby latch release (or engagement) and module extraction (or 
insertion) can be accomplished at one single grasping point thus eliminating 
the numerous translational motions previously described. 

This simplification can be effected (Figure L-6) by designing 
the module grasping point as an integral part of a slide assembly which 
is a mechanism containing a ball-lock-type detent or spring-loaded plunger 
that is seated in a suitably shaped groove. The end of the slide opposite 
the grasping handle is attached to a toggle arrangement that directs 
(electrical) power via switches to linear actuators controlling closing/open- 
ing of the module latches. Movement of the slide from one detent to another 
opens (or closes) the latches. Continuation of the movement (for example, 
a "pull" to unlatch) results in extraction of the module. With this design, 
only one straightline motion (no rotations or lateral translations) at one 
point is required to extract or replace a module. 
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Figure L-5. Module Handling System, Concept 1 



Modulfl Grasping Point 
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Figure L-6. Module Handling System, Concept 2 



It is recommended that the modular elements of on-orbit main- 
tainable payloads be designed to reduce the number of motions and the 
number of points at which the required motions are carried out to a minimum 
in order to facilitate module withdrawal/inspection and minimize the time 
in which this function may be carried out. 

G. MODULE BACKUP HANDLING PROVISIONS 

A primary module handling system is required for satellite module 
replacement by the orbiter attached manipulator system. This system 
would consist of the latches^ grasping points^ handles, etc. required to 
transfer modules between orbiter-carried spares and the attached satellite 
via employment of the manipulator system. A backup module handling 
system would ensure completion of this task in the event of primary system 
failure . 

The cost effectiveness of the Shuttle depends to a great extent on 
the ability to repair and/or refurbish the modular components of low-earth 
orbit satellites. A secondary or backup mode of module replacement 
would pexmit the successful accomplishment of this task in the event of 
primary module handling system functional failure. A supplementary 
backup system can be provided with little or no addition of hardware 
elements to the basic system. The versatility of this system can be 
enhanced by the addition of a backup system that would be operable by the 
manipulator if a failure occurs in any of the elements (mechanical or 
electrical) comprising the primary system. 

The primary system described as an automatic system is de- 
signed to minimize the number of operations required to effect module 
change-out by means of the manipulator. The system contains electrically 
controlled linear actuators that are used to operate the latches securing 
the module(s) to the satellite structure. If the actuators were equipped 
with an over-ride device (e.g., a slip clutch) and the latches designed to 
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furnish integral external handles (grasping points), as shown in Figure L>7, 
the latches could always be released and/or engaged by the remote manipulator 
thus making it always possible to mechanically replace a module in the 
event of a mechanical or electrical failure in any element of the primary 
module handling system. 

H. RECOMMENDED TRADEOFF STUDIES 

I . DOCKING SYSTEMS 

For the design studies performed as an aid in developing design 
guidelines, a modified Apollo probe and drogue docking system was selected 
for use with the service vehicle concept. The system was modified for 
unmanned use by removing those components normally used for the manned 
removal of the probe from the Apollo crew transfer tunnel. In addition, 
an indexing latching system, consisting of three latches on the nose of the 
probe which would engage in three slots in the bottom of the cone once the 
service module was indexed property relative to the spacecraft, was 
incorporated. 

The Apollo docking system was selected for the design studies 
because it is a proven workable system and because it was easily adaptable 
to the concept generated for the space serviceable spacecraft. However, 
no tradeoff studies were performed to determine the impact of the type 
of docking system chosen on the design of the spacecraft, service module, 
replaceable module, or module transfer techniques. 

Other docking systems have been studied and designs generated. 

For example, described in Reference L-7 is a docking frame with capture 
latches and guide arms udiich may offer some advantages over the Apollo 
system, depending on the type of spacecraft configuration chosen. 

2. SINGLE VS. MULTIPLE LAUNCHES 

Tradeoff studies should be performed to determine if there is any 
advantage in designing the spacecraft (ground refurbishable and expendable 
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Figure L-7, Module Handling System, Concept 3 




as well as on-orbit maintainable) such that more than one can be launched 
with the Shuttle. 


Some spacecraft operational schemes will probably require more 
than one payload of the same type spaced apart within the same orbit or 
perhaps in different orbits. To satisfy requirements of this nature, it 
could be advantageous to launch more than one payload with a single Shuttle. 
The weight and geometry of the given payload must, of course, be such 
that the Shuttle payload bay can accommodate more than one payload. 
Assuming this requirement is satisfied, the impacts on the design of 
spacecraft for multiple launch should be determined. This would include 
determination of extra attach structure required, increased loads on the 
basic structure, release mechanisms, and associated failure modes, etc. 

Multiple launches should not be limited to payloads of the same 
design. It may also be advantageous to consider launch of two completely 
different types with a single Shuttle launch. 

I. REFERENCES 


L-1. DSP Space Servicing Study, Supporting Analysis, TOR-0073(3421-07)- 1, 
Voi. Ill, The Aerospace Corporation, fc:i t>egundo, Calif. 

(15 August 1973). 

L-2. Earth Observatory Satellite (EOS) Definition Phase Report, Vol. I, 

NASA Goddard Space Flight Center, Greenbelt, Md. 

(August 1971). 

L-3. Quick- Disconnect Coupling Assembly, Test Report, NASA TR-332-D, 

(l2 August 1966). 

L-4. E. C. Wilson, et« al.^ Development of Separable Connectors for 

the Saturn S-IV Stage , l!>ouglas Aircraft Co^ Santa Monica, Calif. (1965) 

L-5. D. E. Stuck, et. al.. The Practical Aspects of Static- joint Leakage 
Monitoring^ , Rocketdyne, (19b5), ^ 

L-6. R. I. Cedar-Brown, Leakage Detection and Measurement, 

General Electric Co., (1965). “ 

L-7. DOD Upper stage /Shuttle System Preliminary Requirements Study, 

Vol. 3, McDonnell Douglas Astronautics Co., Huntington Beach, 

Calif. (August 1972). 


L-30 



APPENDIX M. RELIABILITY 


To achieve cost savings with on-orbit repair, failure modes leading 
to loss of payload or preventing on-orbit repair must be identified and their 
effect minimized. Addition of selective redundancy to critical areas or 
simple design changes are generally all that is required. To insure repair 
success and reduce revisit frequency, sufficient telemetry and instrumen- 
tation are required to identify the failed module and other modules with such 
extensive degradation that they will likely fail before the next scheduled re- 
visit. The ability to retrieve failed modules from orbit will allow realistic 
corrective action to be taken on future payload designs. 

A. EXPENDABLE PAYLOADS 

Although modularization is not inherently required for expendable 
payloads, it can lead to early standardization and to decrease test problems. 
For example, if three different payloads each require a 12-volt regulator 
all with the same requirements except current output, a separate regulate*^ 
would be built for each program. It might be desirable to use the one with 
the maximum current output for all three, but this is usually prevented by 
weight, size, configuration, and interface restrictions. In the Shuttle era, 
a modularized standard regulator could be used in all cases, since these 
restrictions can be removed by standardization. 

Curve A of Figure M- 1 is a typical reliability growth curve using 
today's methods, while Curve B is a hypothetical growth curve for a 
similar program in the Shuttle era. The large improvement in reliability 
should result from usage of standardized modules. Some of these modules 
will already have had considerable reliability growth, since they may 
have been used in a variety of previous program. Table M-1 lists some 
of the advantages of standardization and how they affect the program relia- 
bility, design, cost, and schedule. High reliability (hi-rel) parts will 
probably still be required for the same reasons as today. 
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Figure M-1. Reliability Growth of a Typical Payload 
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Table M-1. Advantages of Standardization 
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B. ON-ORBIT MAINTAINABLE 


For on-orbit maintainable payloads, most failures are corrected by 
replacement of modules on orbit. The cost of on-orbit repair includes the 
cost of the module to be repaired plus the shared cost of the Shuttle flight. 

If ground repair is required, the cost includes the repair cost plus the cost 
to bring the payload to earth and after repair, to replace it in orbit. If a 
spare payload is available on the ground, it can be used to replace the failed 
payload (on orbit). Cost savings should result, since the failed payload can 
be returned to earth on the same trip. If a payload is "lost" and cannot be 
retrieved, a new payload must be built and placed in orbit. An approximate 
cost and cost ratios for various strategies are shown below for a $30M unit 
cost payload and $10. 3M launch cost: 


Strategy 

Launch 

Cost 

Repai r 
Cost 

Total 

Cost 

Approx. 
Cost Ratio 

On-orbit Repair 

$10. 3M/4 


$ 4. 58M 

1.0 

Gi^ound Repair 

$10. 3M/2 


$ 7. 15M 

1.6 

Payload Replacement 

$10. 3M 


$40. 3M 

8. 8 


The cost of an on-orbit maintainable payload is greatly reduced, 
e.g., from $4U. 3M to $4.58M; however, some change should be expected 
in the part quality requirements area. If the choice were between hi-rel 
and MIL STD parts, then hi-rel parts would still generally be selected 
since MIL STD parts failure rates are about five to ten times higher than 
high reliability parts. The MIL STD parts are two to three times lower 
in cost, but parts represent only 10% of the payload unit cost. Using the 
previous example, the payload unit cost will be less for MIL STD parts by: 
A parts cost ($30M) (10%) (3-1) = $2M 
However, the operating cost will increase due to the increase in payload 
replacement rate. As an example, if a five times increase in parts failure 
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increases payload failures by two times to ac ount for nominal redundancy, 
the operations cost will increase by: 

^ operations cost = ($4.58M) (2-1) = $4. 58M 
or a total increase of $2.58M ($4.58M - $2.0M) using MIL STI' parts. The 
reliability of a MIL STD unit can be increased by increasing redundancy to 
reduce the payload failures. This approach must be traded against increases 
in cost for parts, testing, and refurbishment. Rather than using MIL STO 
parts which have high failure rates, intermediate quality parts may be more 
appropriate, since high reliability parts are basically established from the 
rigorous screening test of MIL STD parts. 

Figure M-2 shows the effect of failure rate from putting more 
money into screening. Table M-2 shows these different screening require- 
ments, while Table M-3 shows relative cost, failure rates, and lead times 
for the devices. Although data showing the effectiveness of individual screen- 
ing tests is generally not available, it is suspected that certain tests have not 
been optimized for screening effectiveness. 

1. Test Time. - The burn-in time for Class B parts (Table M-2) 
is 168 hours (one week). It may not have been optimized. 

2. Obsolescence - When centrifuge testing was first performed 
(on transistors in the 1950 's), it was an effective method of 
checking poor lead bonding. However, today, integrated 
circuit leads are much lighter, and this test rarely generates 
enough force to show a weak bond (that would not show in 
another test). 

Although screening tests will be maintained, reduction may be 
advisable in certain areas. The criteria generally would be that any test, 
whose cost was not less than the savings resulting from the decrease in 
repair flights costs (because of failure rate reduction), should not be incor- 
porated.*^ In some cases, redundancy may be more cost-effective than 
adding a screening test, although this may lead to more extensive on-orbit 
repairs. 


All costs connected with the higher failure rate must be considered; e.g., 
additional ground testing and repair, more extensive on-orbit repair, and 
longer periods of outage. 
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Part Failure 
Rate 

(per hour 
X 10-9) 



Figure M-2. Reduction in Failure Rate Resulting From 

Addition of Screening Tests (IC's per MIL-STD-883) 
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Table M-2. Screening per Method 5004-MIL-STD-883 


TEST 

CLASS A 

CLASS B 

CLASS C 

Precap Visual 

Yes 

Yes 

Yes 

Bake (Stab*) 

Yes 

Yes 

Yes 

Thermal Shock 

Yes 

No 

No 

' emperature Cycling 

Yes 

Yes 

Yes 

Mechanical Shock 

Yes 

No 

No 

Centrifuge 

Yes (High) 

Yes (Medium) 

Yes (Low) 

Hermeticity 

Yes 

Yes 

Yes 

Electrical 

Yes 

Yes (Less) 

No 

Bum-In 

240 hr 

168 hr 

No 

Reverse Bias (bura-in) 

Yes 

No 

No 

Radiograph 

Yes 

No 

No 


Table M-3. Failure and Cost Information on 

MIL-M- 38510 IC's (T^L-Construction) 


CLASS A 


CLASS B 


CLASS C 


-9 

Failures per 10 hr 

Cost* per Device 
(in Ek>llars) 

Procurement Lead Time 


20.4 

12 

20 weeks 


* For procurement lots at 1000 devices. 


40.7 
8.5 
4 weeks 


407.9 
2.5 
In Stock 
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One area in which MIL STD parts might be considered is in the 
experiements under the following conditions: 

1. Data are not urgently required. 

Z. The experiment is a small part of the mission. 

3. Many other more important experiments are carried. 

4. Failure of the experiment doesn't affect other areas 
of the payload. 

Then, if one of this type experiment fails, it will not be repaired until 
the payload is visited for some other reason. 

Today, if a payload fails, the only information on the cause of 
failure comes from telemetry (TLM) data. Often this is not effective in 
really explaining what has happened. Because of this: 

1. Extra design time and effort are used before flight. 

Z. EIxtra testing is performed before flight. 

3. Ehctra TLM and instrumentation are required even in non- 
critical areas in order to pinpoint causes of failure. 

4. When failures actually occur, extensive and expensive test 
and design evaluation programs are conducted (on the ground). 

5. Since the problem still cannot be pinpointed in some cases; - 
e.g., low frequency, intermittent-type failures, extra 
redundancy and other expensive and cautious design approaches 
are used on succeeding flights. 

In the Shuttle era, the failed module can be returned to ground and 
a complete failure analysis performed. Degraded modules that were also 
being changed, together with experimental data, could also be returned and 
analyzed. 

The general concept of degraded or payload survival state is im- 
portant in preventing payload loss. Although requirements vary from payload 
to payload, this concept of degraded state is illustrated for the following sub- 
systems. 

1. Attitude Control - For many experiments very fine control 
of attitude is required to provide proper pointing, platform 
stability and position determination. However, to prevent 
tumbling and insure safe pickup a less complex attitude 
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control system can be used. This can be accomplished either 
by using a low cost completely redundant attitude control 
system or by using selective redundancy in the present system. 
For example* a lower gain feedback amplifier might be used as 
backup for the high gain amplifier now required for high 
stability. 

Z, Thermal Control • Thermal control is required for stability 
of operation and to prevent damage from excess heat or cold. 
Module thermal independence is generally desirable. After 
failure* while awaiting payload repair, it is mainly required 
to supply sufficient heat to prevent damage by cold. Thus* to 
achieve this objective one change might be to always use two 
smaller heaters* rather than one large one* so that either 
could supply enough heat to prevent widespread damage in a 
module* if the other heater failed. 

3. Partial Operation of the Computer - During normal operation 
the computer is the brains of the mission. After failure it is 
still required to provide control of functions such as attitude 
control* thermal control* and the power distribution (to 
critical areas). The computer could either be made partially 
redundant in these areas* or be programmed* after failure* 
to use other areas that usually control non-critical functions* 

4. Communications ~ After failure* sufficient up and down link 
capacity must be maintained to insure operation of those 
housekeeping functions* required for survival* which are con- 
trolled from the ground. They will vary considerably from 
payload to payload* i.e.* the greater the on-board computer 
capacity the less the requirement. An extreme example of 
high requirements would be a ’’fly by wire” mission. Usually 
less control is required and a degraded system capabh: of 
detecting safety related items, e.g.* leaking fuel* and pro- 
viding some backup for the on-board computer would be 
sufficient. 

5. Power - The payload design should be such that a lower level 
of both regulated and unregulated power necessary to insure 
survival is provided after single point failures of the power 
system. The design of the experimental area should be such 
that* except for thermal control* it does not require power for 
survival while awaiting repair. 

Table M-4 shows how a single string power supply might be changed 
to prevent loss of the payload after a failure. Appendix N shows how the 
present FMEA procedures could be extended to verify this type of effort 
had been accomplished throughout the payload. In this example* it is 
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Table M-4, Example - FMEA of a Single String Power Supply 
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assumed that one-half of normal power is required for payload survival 
including one--.ifth of all regulated power. This power is used in critical 
areas of the subsystems. The requirements of power necessary to prevent 
loss of the payload are the minimum power requirements for the attitude 
control, thermal system, command, and communications to insure that the 
payload survives until retrieved. 

This example shows how design changes, operational change, and 
selective redundancy can be used to prevent loss of a payload. For a design 
change, the single battery would be replaced by two batteries, each half the 
size of the original battery, so that either could supply power for survival 
a^ter the other had failed. After failure, all non-critical items would be turned 
off and on-orbit repair would be scheduled before the batteries became de- 
pleted. An example of selective redundancy is shown in the voltage regulator 
area. Each regulator is divided into two sections, one for critical and one 
for non-critical users. The critical section would be made redundant. It 
should be noted that program cost savings result from these changes. 

If the module that contains the failure is totally unknown, the payload 
must be returned to the ground for refurbishment. If the failure can be 
isolated to a small number of modules, replacement modules can be carried 
in the Shuttle and changed on the payload. 

The impact of failure identification on the required number of 
launches per year is shown in Figure M-3. The top set of curves shows 
the reliability function? of the various modules, including a truncated 
module. The system reliability is determined by multiplying all the module 
reliabilities together. 

The bottom set of curves is a plot of number of launches per year 
against the number of modules changed during each on-orbit repair visit 
including the failed module* The curves range from no information, except 
that a specific module has failed, to some information on the status of 
other modules. If perfect infomation were available, the launch rate would 
be even lower. 
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Figure M-3. Impact of Failure Identification 
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A few of the indicators of module status that may foretell early 
failure are: 

1. Redundancy - The module failure rate will increase after 
redundant circuit(s) in a module fail. 

2. High Temperature * A module operating above its predicted 
temple rature may be approaching failure 

3. Experiments - Immediate repair of a failed experiment may 
not be necessary; however, it would be repai -ed the next time 
the payload was visited for some other reason. 

4. Wearout - Several components give signals indicating the 
approach of wearout. These include batteries giving poor 
voltage recovery after discharge during an eclipse, TWT*s 
with low emission, and electromechanical devices indicating 
noise and sluggish operation. 

5. Fuel Depletion - The fuel reserve is usually measured today 
and should be continued on these types of payloads. 

Using standardized modules on this type of payload is an advantage, 
since almost all failure modes that lead to loss of payload or prevent on- 
orbit repair will have been identified and appropriate corrective action will 
have been taken through maturity. Also, the TLM-instrumentation will be 
developed to monitor moi. de degradation information. 

C. GROUND REFURBISHABLE 


Much of the above analysis holds true for ground- refurbishable pay- 
loads; however, the economic advantages of eliminating failure modes which 
can cause loss of the payload are expected to be smaller. Detailed TLM 
and instrumentation are not required for this type of payload. They need 
only be sufficient to show that the payload is safe for retrieval, to show 
>^en major failure modes are approaching (on-orbit), and to aid in trouble- 
shooting during ground repair. 

Standardization is important for the same reasons as with on-orbit 
repair type payloads. Also, modularization will allow design improvement 
to be added during refurbishment. Only rarely will other than hi-rel parts 
be cost-effective, e.g., elimination of very expensive screening tests that 
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provide little reduction in failure rate. Payload can be returned from orbit 
and failure analysis performed in the same manner as with on-orbit maintain- 
able type payloads. 

D. SORTIE 

In Sortie flights, all failures result in loss of the mission except for 
those that can be repaired during flight. The only requirements are that 
failures do not affect Shuttle housekeeping equipment and the crew environ- 
ment must be preserved. This mission type has low TLM and instrumentation 
requirements. Instead, test points may be available for use by crewmembers 
(using hand instrumentation). Since many payload (experiments) use the same 
function repeatedly, e.g. , amplifier in a solid-state antenna, a few of these 
could be carried and repairs made by the crew, if necessary. This repre- 
sents another reason for modularization, standardization, and interchange- 
ability requirements on this type of mission. MIL STO parts can be used 
in areas where repairs can be made on orbit. Not only can failed modules 
be returned to earth, but tests can be conducted on orbit for even better 
failure information. 

E. CONCLUSIONS 

System engineering must consider major failure modes so that 
requirements can be placed on the subsystems during early design stages to 
minimize the effects of such failure modes. 

System engineering must specify the TLM instrumentation require- 
ments necessary to identify failed modules and major degradation of modules. 

The subsystem designers should consider approaches that will use 
features provided by the Shuttle, e.g., splitting the battery into two parts 
and low level redundancy in critical areas. 

A method must be developed to insure that the above tasks have 
been satisfactorily accomplished. Present FMEA procedures should be 
extended to cover these tasks. 
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Standardized modules should be used, where possible, for all 
housekeeping payload functions* 

The effectiveness of individual part screening tests should be 
reviewed to determine their effectiveness in reducing payload costs. 

Redundancy should be considered in lieu of expensive screening 
tests, expecially on on-orbit repairable and sortie payloads* 

The ability to perform failure analyses on hardware returned from 
space will decrease design complexity and R&D, testing time and cost, 
and increase reliability on future flights* 
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APPENDIX N. FMEA PROCEDURE 


This is an example Failure Modes and Effects Analysis (FMEA) 
to illustrate how the FMEA may be extended to the Shuttle payload. 

1. PAYLOAD TYPES 

These procedures are intended to be used for on-orbit maintain- 
able and* where applicable* with ground refurbishable payloads. 

2. PURPOSES 

The purpose of this procedure is to extend the present FMEA 
procedures so that following additional information can be obtained. 

(1) Identify areas where failure(s) lead to the loss of the payload. 

(2) Identify areas where failure(s) prevent repair of a payload 

on orbit. 

(3) Identify areas where failure(s) may require more than one 
re-visit to repair a payload on-orbit. 

(4) Identify TLM indicators that will aid in the selection of 
modules to be changed during on-oibit repair* in addition to the failed 
module. 

(5) Identify areas where new instrumentation and TLM should 

be considered. 

3. ASSUMPTIONS 

The following activities must be performed before this procedure 
can be used. 

(1) The payload requirements relative to Shuttle safety must 
be established. 

(2) The requirements for payload survival both at the system and 
subsystem levels must be established. (See Attachment 1) 
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(3) The requirements for identification of failed modules must 
be established at the system and subsystem level. (See Attachment 2). 

(4) An FMEA analysis of the type presently performed for NASA 
payloads must be accomplished and the following information must be avail- 
able (for each failure mode). 

(a) The effect that the failure mode has at the subsystem 

level. 

(b) The effect that the failure mode has at the system level. 
(In addition the effect, must be shown, as if redimdancy were not present, 

if applicable. 

(c) The TLM or other indication that shows where the 
failure has occurred. 

(d) An identification niunber. 


4. PROCEDURE 

4. 1 Failure Classification 

The following procedure shall be followed to classify failures, 
reduce the likelihood of serious modes and identify those that remain. 

(1) hisure that a FMEA has been performed and the type of 
information supplied in Attachment 1 and Attachment 2 (if applicable) is 
available. 

(2) Classify each of the failure modes per the table and according 
to instructions given in Attachment 3. 

(3) Determine that all Class 1 (single point safety) failures 
have been eliminated, if possible, by design change or with redundancy. 

(It seems likely that a Shuttle safety organization will be required to approve 
any exceptions). 

(4) Recommend corrective action to reduce the effects of Class 
2 and Class 3 failures (e.g., selective redundancy). Where the corrective 
action seems expensive, or otherwise vindesirable, a cost analysis shall be 
performed. 
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(5) Prepare a list showing all remaining Class 1, 2 and 3 
failure and an explanation of why they had not been eliminated. 

4* 2 Indicator Classification 

The failure indicators shall be reviewed (for each failure mode), 
to insure that they comply with the requirements of Attachment 4. Where 
deficiencies are noted new instrumentation and TLM channels shall be 
recommended. 

4. 3 Module Selection 

For each space repairable module, a list shall be prepared cross 
referencing the failure mov^e identification number to the failure classes as 
shown in Attachment per the example in Table I. This list shall be used as 
a guide for selecting modules to be changed, in addition to the failed module, 
during on-orbit repair, e.g. , a Class 4 or 5 failure has top priority, since 
either indicates a SPF that could lead to loss of the payload. 

Table I Failure Mode Classification Example 


Failure 

Failure Mode 

Class 

Identification Number 

4 

7. 9. Ill 


5 

12, 15 

. Example ID 

6 

10, 9 

Numbers 
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APPENDIX N, ATTACHMF " 1 
SAMPLE OF PAYLOAD SURVIVAL PROCEDURE 


1. PURPOSE 

This Attachment is the procedure that would be followed by design 
engineering to identify conditions required for payload survival. 

2. REQUIREMENT 

The payload shall be analyzed to determine the minimum type(s) 
and level(s) of outputs required for its survival imtil repaired on-orbit or 
returned to earth, for repair. The information shall be obtain«jd at th? 
subsystan level (or lower if required). 

3. DEFINITION 

A payload is considered "lost" under the following conditions. 

(1) It cannot be recovered or is unsafe to recov* . 

(2) It has extensive damage ana repairs are uneconomical. 

4. CONDITION LEADING TO PAYLOAD LOSS 

Listed below are conditions that can lead to loss of payload 
together with the subsystems that can affect these areas. 

4. 1 Payload Tumbling 

The payload can tumble (or be in an unrecoverable orbit). 

This can result from selective failure of the attitude control, power , 
computer or communications subsystem. 

4. 2 Payload Unsafe 

The payload may be unsafe to dock with due to failures of 
docking mechanism or leakage of dangerous substances. They include 
hydrogen, chemicals or radioactive material. Also the instrumentation 
- TLM (and power) necessary to determine the status of these dangers 
must be operational. 
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^ Failure Isolation 

A failure may cause secondary failure(s) which make the payload 
unrecoverable or too expensive to fix. The trcinsient effect of each failure 
mode must be considered. Anv subsystem has the potential to cause this 
type of problem, e.g., heat from a short before removal from the line. 

Also the shock from a violent A/C maneuver, upon failure, must be 
considered. 

4. 4 Thermal 

After failure, the payload must oe able to stand the thermal 
envir'^nment of space. This requires thermal control, heaters, heat shields, 
power and possibly A/C and communications. 

4. 5 Capture or Storage Damage 

The payload can be lost luring capture if the docking mechanism 
is defective or if sudden failures occur in the A/C and related areas. No 
problems during stored reentry have been identified. 

5. OUTPUTS 

The resuito shall be used as a guide for subsyscem designers 
and FMEA evaluation personnel. The following is typical of the infor- 
mation to be provided on some of the subsystems. 

5. 1 Power Subsystem 

(1) Unregulated power 

(2) Regulated power 

(3) Time dependence of power 

5.2 TLM 

(1) Critical channels 

5. 3 Computer (Controller) 

(1) Required action and channels 
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5.4 Attitude Control 

(1) Transients allowable 

5. 5 Thermal 

(1) Minimum heaters 

(2) Heater controls 

5.6 Communications 

(1) Which transmitter and receivers are needed 

5. 7 Safety 

(1) Any safety areas 
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APPENDIX N. ATTACHMENT 2 
SAMPl-E OF FAILED MODULE IDENTIFICATION PROCEDURE 


1. PURPOSE 

This Attachment is a sample of the type of procedure that would 
be followed by design engineering to identifying conditions preventing on* 
orbit repair. 

2. REQUIREMENT 

The payload shall be analyzed to determine the minimum type(s) 
and level(s) of outputs required to insure identification of the module that 
has failed. This information shall be obtained at the subsystem level (or 
lower if required)* 

3. DEFINITION 

A payload is considered unrepairable if any of the following 

occur. 

(1) Communication is lost with the payload 

(2) The TLM information is insufficient to isolate the failure 
to three replaceable modules. 

(3) The module can not be changed on*orbit* 

4 . NON.REPAIRABILIT Y 

The following condition can lead to the payload not being 
repairable omorbit (in one trip)* 

4* 1 Communications 

Communications necessary to identify the failed channel may be 
lost. This can be caused by critical failures of TLM channels, communi- 
cations, power, and certain failures of the A/C and its control which make 
communications impossible, e.g., the antenna(s) are out of position. 
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4.Z 


TLM Information 


Insufficient TLM information usually results from limitations 
on TLM channels and/or instrumentation. Sometimes the failure can 
be isolated to two (three) replaceable modules and all can be changed but 
at a cost penalty. 

4. 3 Module Replacement 

The module may not be replaceable (on-orbit) if the exchange 
mechanism is jammed or if an output of the module, to be replaced, is 
required durii^ the replacement period. 

5. OUTPUT 

The results shall be used as a guide for the subsystem designers 
and FMEA evaluation personnel. The following is typical of the information 
to be provided on some of the subsystems. 

5. 1 Power Subsystem 

(1) Regulated power 

5.2 TLM Channels 

(1) Critical channels (e.g. , some may be lost and failed 
module still can be identified). 

5. 3 Computer 

(1) Control in TLM area. 

5.4 Instrumentation 

(1) Critical areas 

5. 5 Attitude Control 

(1) If applicable to communications 
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APPENDIX N, ATTACHMENT 3 
SAMPLE OF FAILURE CLASSIFICATION PROCEDURE 

1. PURPOSE 

This procedures provides information to the FMEA evaluation 
personnel for grading the effect of failures. This information is necessary 
for design change recommendations and to aid in selection of modules, other 
than the failed module, to be changed during on-orbit repair. 

2. REFERENCES 

( 1 ) Attachment 1 

(2) Attachment 2 

3. PROCEDURE 

Using the outputs of References 1 and 2 and other design 
information, the effect of each failure shall be classified as shown in 
Paragraph 4 below. 

4. METHOD 

(1) Table 1 is a list of classification versus condition of the 
payload after a failure has occurred. (Example - Class 4) 

(2) If a failure is time sensitive then it shall be listed as 

follows: 

Class - (#1) - T { [t] 

#1 - class until tirr. t 
#2 - class after time t 
t - time (in days) to change class 
(Example A 4 becomes a 2 in 2 weeks) Class 4 - T2 (14) 
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Table 1. Failure Classification 
(Condition After Failure Occurs) 


Class No. 

Remarks 

1 

Safety hazard (is a safety problem in Shuttle bay; or, if 
in space, will be if captured by the Shuttle.) 

2 

Payload lost 

3 

Payload required ground refurbishment 

4 

Payload re 4 uires groimd refurbishment 

5 

Payload has a SPF leading to 1 

6 

Payload has a SPF leading to 2 

7 

Payload has a SPF leading to 3 

8 

Payload has a SPF leading to 4 

9 

Experiment failure (25-50% data lost) 

10 

Experiment failure (10-25% data lost) 

11 

Experiment failure ( < 10% data lost) 

12 

Major module degradation 

13 

Minor module degradation 

14 

Negligible module degradation 
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APPENDIX N, ATTACHMENT 4 

SAMPLE OF FAILURE INDICATOR REQUIREMENT PROCEDURE 


1. PURPOSE 

The purpose of this Attachment is to recommend requirements of TLM 
information for \^arious classes of failures. 

2. PROCEDURE 

The FMEA evaluation personnel shall determine if the Instrumentation 
and TLM requirement of Table 1 are met for each class of failure. Recom- 
mentations shall be made for additional TLM and Instrumentations* with 
cost tradeoff, as necessary. Also recommendations for reductions should 
also be made, where applicable. 

3. REFERENCE 

Table 1 of Attachment 3. 


Table 1. Failure Indicator Requirements Chart 


Class (See Table 1 of 
Attachment 3) 


Requirement 
(See code below) 


1 

2 

3 

4 

5 

6 

7 

8 
9 

10 

11 

12 

13 

14 

15 


A 

N/A 

A 

B 

A 

A 

A 

C 

D depends on cost of instrumentation 
D depends on cost of instrumentation 
D depends on cost of instrumentation 
E 
C 

E (not required) 

E (not required) 


Code 

A - Positive "fail safe" indicator, i.e, , failure indication of indicator failure 
also required. 

B - Positive indicator - Isolated to 1 module 
C - Positive indicator - Isolated to 2 modules 
D - 50% chance of isolating experiment 
E - Indicator, if economically justified 
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